@rallycry/conveyor-mcp 5.0.2 → 5.0.3

package/dist/cli.js

@@ -67,12 +67,84 @@ function registerProjectTools(server2, conn2) {
 }
 
 // src/tools/connection.ts
-import { z as z3 } from "zod";
+import { z as z4 } from "zod";
 
-// ../shared/dist/chunk-OKJPFFQI.js
+// ../shared/dist/chunk-42BS7Y35.js
+import { z as z2 } from "zod";
+var DEFAULT_SONNET_MODEL = "claude-sonnet-5";
+var DEFAULT_OPUS_MODEL = "claude-opus-5";
+var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
+var FABLE_MODEL = "claude-fable-5-1";
+var PREVIOUS_SONNET_MODEL = "claude-sonnet-4-6";
+var PREVIOUS_OPUS_MODEL = "claude-opus-4-8";
+var PTY_STREAM_PORT_BASE = 7420;
+var PTY_STREAM_PORT_ATTEMPTS = 8;
+var PREVIEW_PORT_DENY_LIST = [
+  5432,
+  6379,
+  9200,
+  ...Array.from({ length: PTY_STREAM_PORT_ATTEMPTS }, (_, i) => PTY_STREAM_PORT_BASE + i)
+];
+function normalizeCheckpointPath(value) {
+  let normalized = value.trim().replace(/\/{2,}/g, "/");
+  normalized = normalized.split("/").filter((segment) => segment !== ".").join("/");
+  while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
+  return normalized;
+}
+var checkpointPathSchema = z2.string().transform(normalizeCheckpointPath).pipe(
+  z2.string().min(1).refine((value) => value !== ".", "Checkpoint paths must name a repository entry").refine((value) => !value.startsWith("/"), "Checkpoint paths must be repository-relative").refine(
+    (value) => !/^[A-Za-z]:[\\/]/.test(value) && !value.includes("\\"),
+    "Checkpoint paths must use repository-relative POSIX syntax"
+  ).refine(
+    (value) => !value.split("/").includes(".."),
+    "Checkpoint paths must not traverse a parent directory"
+  )
+);
+var secretNameSchema = z2.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
+var checkpointKeySchema = z2.string().regex(/^[0-9a-f]{64}$/);
+var checkpointDigestRefSchema = z2.string().regex(/^[^\s@]+@sha256:[0-9a-f]{64}$/);
+var ACTIONS_PREBAKE_REGISTRY_PATTERN = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::(?:[1-9][0-9]{0,4}))?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
+var actionsPrebakeRegistrySchema = z2.string().trim().min(1).regex(
+  ACTIONS_PREBAKE_REGISTRY_PATTERN,
+  "Actions prebake registry must be a lowercase host[:port] with an optional path prefix"
+).refine((value) => {
+  const port = /:([0-9]+)(?:\/|$)/.exec(value)?.[1];
+  return !port || Number(port) <= 65535;
+}, "Actions prebake registry port must be between 1 and 65535");
+function uniqueSortedArray(item, minimum = 0) {
+  return z2.array(item).min(minimum).superRefine((values, ctx) => {
+    if (new Set(values).size !== values.length) {
+      ctx.addIssue({ code: z2.ZodIssueCode.custom, message: "Duplicate values are not allowed" });
+    }
+  }).transform((values) => [...values].sort());
+}
+var projectCheckpointSettingsSchema = z2.object({
+  enabled: z2.literal(true),
+  cacheCommand: z2.string().trim().min(1),
+  cacheInputPaths: uniqueSortedArray(checkpointPathSchema, 1),
+  reusableArtifactPaths: uniqueSortedArray(checkpointPathSchema, 1),
+  finalizeCommand: z2.string().trim().min(1),
+  credentialEpoch: z2.string().trim().min(1),
+  requiredSecretNames: uniqueSortedArray(secretNameSchema).optional(),
+  optionalSecretNames: uniqueSortedArray(secretNameSchema).optional(),
+  bakeWebAppBuild: z2.boolean().optional()
+}).superRefine((checkpoint, ctx) => {
+  const required = new Set(checkpoint.requiredSecretNames ?? []);
+  for (const name of checkpoint.optionalSecretNames ?? []) {
+    if (required.has(name)) {
+      ctx.addIssue({
+        code: z2.ZodIssueCode.custom,
+        path: ["optionalSecretNames"],
+        message: "A secret cannot be both required and optional"
+      });
+    }
+  }
+});
 var CARD_DESCRIPTION_MAX = 255;
 var CARD_DESCRIPTION_LIMIT_MESSAGE = `Card descriptions are capped at ${CARD_DESCRIPTION_MAX} characters \u2014 write 1-2 plain sentences a non-engineer can read; put technical detail in the plan or card chat.`;
 var CARD_DESCRIPTION_FIELD_HINT = `max ${CARD_DESCRIPTION_MAX} chars, 1-2 plain sentences a non-engineer can read \u2014 put technical detail in the plan`;
+var DEFAULT_CI_WAIT_TIMEOUT_MINUTES = 45;
+var MAX_CI_WAIT_TIMEOUT_MINUTES = 180;
 var SEVERITY_ENUM = [
   "DEBUG",
   "INFO",
@@ -337,7 +409,7 @@ var postToChatContract = defineToolContract({
       ),
       milestone: f.optional(
         f.enum(["plan_ready", "implementation_complete", "blocked"], {
-          desc: "Declare a narrative milestone instead of a routine update. Use SPARINGLY \u2014 only when the plan is ready, implementation is complete, or you are blocked. Milestones appear on the card's activity timeline and in Slack."
+          desc: "Declare a narrative milestone instead of a routine update. Use SPARINGLY \u2014 only when the plan is ready (plan_ready), implementation is complete (implementation_complete), or you are parked and cannot continue until a human acts (blocked). `blocked` posts a note and enables reply delivery but pages nobody; to page a person, ask them with AskUserQuestion. Never use `blocked` for a finished plan, finished work, or a tool error you can retry. Milestones appear on the card's activity timeline and in Slack."
         })
       )
     }
@@ -457,25 +529,6 @@ var searchTasksContract = defineToolContract({
     }
   }
 });
-var childTaskIdForMerge = f.string({
-  desc: "The child task ID whose PR should be approved and merged"
-});
-var approveAndMergePrContract = defineToolContract({
-  name: "approve_and_merge_pr",
-  agent: {
-    description: "Approve and merge a child task's PR. Preconditions: child in ReviewPR. Returns { merged }: true = merged (status\u2192ReviewDev); false = automerge queued, wait for ReviewDev. Requires project Admin, or a sub-project merge grant covering every changed file; release PRs require Admin.",
-    fields: {
-      childTaskId: childTaskIdForMerge
-    }
-  },
-  mcp: {
-    description: "Approve a child task's pull request and QUEUE it for merge \u2014 the merge lands asynchronously (~30s sweep) once the CI and code-review gates pass; the response says whether it merged or was queued, so verify PR state before depending on it. Pass projectId to target a specific project; otherwise the configured default project is used. The child task must be in ReviewPR status with a PR. Requires project Admin, or a sub-project merge grant covering every changed file; release PRs require Admin.",
-    fields: {
-      projectId: mcpProjectId,
-      childTaskId: childTaskIdForMerge
-    }
-  }
-});
 var getConnectionContextContract = defineToolContract({
   name: "get_connection_context",
   agent: {
@@ -495,7 +548,6 @@ var tasksContracts = [
   readTaskChatContract,
   listTagsContract,
   searchTasksContract,
-  approveAndMergePrContract,
   getConnectionContextContract
 ];
 var STATUS_ENUM = [
@@ -886,12 +938,12 @@ var updateSubtaskContract = defineToolContract({
       plan: f.optional(f.string()),
       status: f.optional(
         f.enum(["Planning", "Open"], {
-          desc: 'Move the child between "Planning" and "Open". "Open" marks it ready to execute \u2014 required before start_child_cloud_build. Execution statuses transition automatically.'
+          desc: 'Move the child between "Planning" and "Open". "Open" marks it ready to execute \u2014 the pack runner takes Open children in dependency order. Execution statuses transition automatically.'
         })
       ),
       agentIdOrName: f.optional(
         f.string({
-          desc: "Assign a project agent to the child (agent id or exact name from the Project Agents list). Required before start_child_cloud_build."
+          desc: "Assign a project agent to the child (agent id or exact name from the Project Agents list)."
         })
       ),
       ordinal: f.optional(f.number()),
@@ -943,7 +995,7 @@ var deleteSubtaskContract = defineToolContract({
 var listSubtasksContract = defineToolContract({
   name: "list_subtasks",
   agent: {
-    description: "List all subtasks under the current parent task. Default compact view returns per child: status, agent, story points, PR number/state, and dependencies. On a FAN-OUT pack it also returns holdsBuildSlot per child plus a packSlots summary (in-flight environments vs the PACK_CHILD_LIMIT cap, and which children hold the slots); both are omitted on the default single-pod path, where one pod implements every child and nothing holds a slot. Use to coordinate child work; pass verbose:true only when you need full description/plan text (large). For non-child tasks use get_task.",
+    description: "List all subtasks under the current parent task. Default compact view returns per child: status, agent, story points, PR number/state, and dependencies (dependsOn + allDependenciesMet). Use to pick the next ready child and record progress; pass verbose:true only when you need full description/plan text (large). For non-child tasks use get_task.",
     fields: {
       verbose: f.optional(
         f.boolean({
@@ -1720,6 +1772,50 @@ var logsContracts = [
   queryGcpLogsContract,
   queryGrafanaLogsContract
 ];
+var SHA = f.optional(
+  f.string({
+    desc: "Commit sha to watch, full or abbreviated. Defaults to the head of prNumber, else this card's PR, else the tip of this card's branch.",
+    min: 7,
+    max: 40
+  })
+);
+var PR_NUMBER = f.optional(
+  f.number({
+    desc: "PR number whose current head to watch. Use this for a child's PR when orchestrating a pack.",
+    int: true,
+    positive: true
+  })
+);
+var TIMEOUT_MINUTES = f.optional(
+  f.number({
+    desc: `Give up after this many minutes (default ${DEFAULT_CI_WAIT_TIMEOUT_MINUTES}, max ${MAX_CI_WAIT_TIMEOUT_MINUTES}); you are woken with timed_out.`,
+    int: true,
+    min: 1,
+    max: MAX_CI_WAIT_TIMEOUT_MINUTES
+  })
+);
+var waitForChecksContract = defineToolContract({
+  name: "wait_for_checks",
+  agent: {
+    description: "Wait for CI without holding the pod. Records the commit to watch on this session and returns immediately: if CI already finished you get the result now; otherwise the reply says `parked` and you must END YOUR TURN with no further tool calls. The pod idles out during the wait and Conveyor wakes this session with the result (success or failure with the failing job names and run URL, head_moved when the PR gets a new commit, timed_out at the deadline). Never poll `gh pr checks`, pr-wait scripts, or a sleep loop for CI. If something else wakes you before the result arrives, handle it and call this again.",
+    fields: {
+      sha: SHA,
+      prNumber: PR_NUMBER,
+      timeoutMinutes: TIMEOUT_MINUTES
+    }
+  },
+  mcp: {
+    description: "Park a task's agent session until GitHub reports the CI result for a commit. Pass projectId to target a specific project; otherwise the configured default project is used.",
+    fields: {
+      projectId: mcpProjectId,
+      taskId: f.string({ desc: "The task whose agent session should wait" }),
+      sha: SHA,
+      prNumber: PR_NUMBER,
+      timeoutMinutes: TIMEOUT_MINUTES
+    }
+  }
+});
+var ciWaitContracts = [waitForChecksContract];
 var TOOL_CONTRACTS = Object.fromEntries(
   [
     ...tasksContracts,
@@ -1734,14 +1830,15 @@ var TOOL_CONTRACTS = Object.fromEntries(
     ...integrationsContracts,
     ...driveContracts,
     ...meetingsContracts,
-    ...logsContracts
+    ...logsContracts,
+    ...ciWaitContracts
   ].map((contract) => [contract.name, contract])
 );
 
 // src/tools/contract-tool.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 function mcpShape(surface) {
-  return compileShape(z2, surface.fields);
+  return compileShape(z3, surface.fields);
 }
 function registerContractTool(server2, contract, handler, options) {
   if (options?.alwaysLoad) {
@@ -1784,8 +1881,8 @@ function registerConnectionTools(server2, conn2) {
     "verify_connection",
     "Prove the connection is correct AND that you can actually write to the intended board \u2014 not just that auth works. Runs layered checks (auth \u2192 account \u2192 project \u2192 target board \u2192 capabilities \u2192 read) and returns a plain pass/fail with, on failure, the exact failing layer and ONE next action. Use this instead of get_project_summary to confirm setup: a summary that returns data proves auth, not scope. Pass intendedActions to verify specific capabilities (defaults to read+create+update). Pass projectId to target a specific project; otherwise the configured default project is used. The board scope comes from CONVEYOR_SUBPROJECT_ID.",
     {
-      projectId: z3.string().optional().describe("Target Conveyor project ID"),
-      intendedActions: z3.array(z3.enum(CAPABILITY_ENUM)).optional().describe(
+      projectId: z4.string().optional().describe("Target Conveyor project ID"),
+      intendedActions: z4.array(z4.enum(CAPABILITY_ENUM)).optional().describe(
         "Capabilities to verify the connection can perform (default: read, create, update)."
       )
     },
@@ -1798,7 +1895,7 @@ function registerConnectionTools(server2, conn2) {
     "list_accessible_subprojects",
     "List the boards (sub-projects) under the connected project \u2014 each with its ID, name, slug, board URL, owned root path, and the role/capabilities this token has on it. Use this to discover which board to create or list cards on (pass a returned id as subProjectId, or set CONVEYOR_SUBPROJECT_ID) instead of asking the human for one. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z3.string().optional().describe("Target Conveyor project ID")
+      projectId: z4.string().optional().describe("Target Conveyor project ID")
     },
     async (params) => {
       const subprojects = await conn2.listAccessibleSubprojects(params.projectId);
@@ -1808,7 +1905,7 @@ function registerConnectionTools(server2, conn2) {
 }
 
 // src/tools/project-config.ts
-import { z as z4 } from "zod";
+import { z as z5 } from "zod";
 var CONTEXT_LINK_LOCATOR_MAX = 300;
 function jsonResult(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -1827,7 +1924,7 @@ function registerGetConnectUrls(server2, conn2) {
     "get_connect_urls",
     "Get browser-only setup URLs to hand to the user: the Google Cloud OAuth connect link (gcpConnect) plus Settings deep links (gcpSettings, memberSettings, projectSettings, setupWizard). Use these for setup steps an agent cannot perform (OAuth grants, secret entry). Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z4.string().optional().describe("Target Conveyor project ID")
+      projectId: z5.string().optional().describe("Target Conveyor project ID")
     },
     async (params) => jsonResult(await conn2.getConnectUrls(params.projectId))
   );
@@ -1837,16 +1934,16 @@ function registerUpdateProjectSettings(server2, conn2) {
     "update_project_settings",
     "Update project configuration: name, description, default agent assignments, or a deep-merged patch of the project settings JSON (JSON Merge Patch: nested objects merge recursively, null deletes a key, arrays replace \u2014 a partial patch never wipes sibling keys). Requires a Moderate project role. Does NOT touch repositories or branches \u2014 those are configured in the Conveyor UI.",
     {
-      projectId: z4.string().optional().describe("Target Conveyor project ID"),
-      name: z4.string().optional().describe("New project name"),
-      description: z4.string().optional().describe("New project description"),
-      settings: z4.record(z4.string(), z4.unknown()).optional().describe(
+      projectId: z5.string().optional().describe("Target Conveyor project ID"),
+      name: z5.string().optional().describe("New project name"),
+      description: z5.string().optional().describe("New project description"),
+      settings: z5.record(z5.string(), z5.unknown()).optional().describe(
         "Deep-merged patch of the project settings JSON (JSON Merge Patch semantics: null deletes a key; advanced)"
       ),
-      defaultPmAgentId: z4.string().nullable().optional().describe("Default PM agent ID"),
-      defaultTaskAgentId: z4.string().nullable().optional().describe("Default task agent ID"),
-      defaultReviewerAgentId: z4.string().nullable().optional().describe("Default reviewer agent ID"),
-      helperAgentId: z4.string().nullable().optional().describe("Helper agent ID")
+      defaultPmAgentId: z5.string().nullable().optional().describe("Default PM agent ID"),
+      defaultTaskAgentId: z5.string().nullable().optional().describe("Default task agent ID"),
+      defaultReviewerAgentId: z5.string().nullable().optional().describe("Default reviewer agent ID"),
+      helperAgentId: z5.string().nullable().optional().describe("Helper agent ID")
     },
     async (params) => {
       const { projectId: projectId2, name, description, settings, ...agents } = params;
@@ -1870,16 +1967,16 @@ function registerUpdateProjectSettings(server2, conn2) {
     }
   );
 }
-var contextPathSchema = z4.object({
-  type: z4.enum(["rule", "doc", "file", "folder"]).describe(
+var contextPathSchema = z5.object({
+  type: z5.enum(["rule", "doc", "file", "folder"]).describe(
     "Kind of context link \u2014 a rule/doc file, a source file, or a folder. All paths are repo-relative; doc marks a synced project doc, which resolves from the workspace like rule/file"
   ),
-  path: z4.string().describe("Repo-relative path, e.g. '.claude/rules/refactor-verification.md'"),
-  label: z4.string().optional().describe("Optional human-readable label for the link"),
-  locator: z4.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional().describe(
+  path: z5.string().describe("Repo-relative path, e.g. '.claude/rules/refactor-verification.md'"),
+  label: z5.string().optional().describe("Optional human-readable label for the link"),
+  locator: z5.string().min(1).max(CONTEXT_LINK_LOCATOR_MAX).regex(/^[^\r\n]*$/, "Locator cannot contain line breaks").optional().describe(
     'Verified-link tether: text that must keep existing in the file for the link to stay live. With locatorType "test" it must appear inside a real it/test/describe TITLE (a renamed test flags the link stale even if its words survive in a comment); with "code" anywhere in the file. Conveyor re-validates links periodically and exposes per-link status in get_tag / manage_tags list. Locators containing <> are documentation placeholders and stay unchecked.'
   ),
-  locatorType: z4.enum(["test", "code"]).optional().describe(
+  locatorType: z5.enum(["test", "code"]).optional().describe(
     "How the locator must match \u2014 required iff locator is set; not valid on folder links"
   )
 }).refine((link) => link.locator === void 0 === (link.locatorType === void 0), {
@@ -1889,24 +1986,24 @@ var contextPathSchema = z4.object({
 });
 var MANAGE_TAGS_DESCRIPTION = "List, create, update, delete, or merge project tags \u2014 the project glossary. create requires name (optional color/description/overview/overviewPath/parentTagIds/contextPaths); update/delete/merge require the tag id. A tag with overviewPath serves its overview from that repo file at the base branch (overview edits are rejected \u2014 edit the file via PR instead; setting/clearing the path is the tag mutation). description (\u2264255) is the summary; overview is the full markdown spec (read with get_tag); parentTagIds is the multi-parent hierarchy \u2014 set it on create, or replace the full set on update; contextPaths wire files/rules/docs into the agent context of any card carrying the tag (replace-set \u2014 pass the full list, [] clears), and a contextPath with a locator becomes a VERIFIED repo link whose status (ok/stale/unchecked) Conveyor tracks against the repo. merge absorbs the tag in id into targetTagId: cards and hierarchy edges move to the target, the target keeps its own description/overview/links, and the absorbed tag is deleted. Use mergePreview first to see the counts. Pass reason on updates and merges \u2014 it lands in the tag's revision history. Mutations require a Moderate project role.";
 var MANAGE_TAGS_SHAPE = {
-  action: z4.enum(["list", "create", "update", "delete", "mergePreview", "merge"]).describe("Operation to perform"),
-  projectId: z4.string().optional().describe("Target Conveyor project ID (list/create)"),
-  id: z4.string().optional().describe("Tag ID (update/delete/mergePreview/merge)"),
-  targetTagId: z4.string().optional().describe("Surviving tag ID for mergePreview/merge \u2014 the tag in id is absorbed into this one"),
-  name: z4.string().optional().describe("Tag name"),
-  color: z4.string().optional().describe("Hex color, e.g. #ff0000"),
-  description: z4.string().optional().describe("Tag description \u2014 the \u2264255-char summary"),
-  overview: z4.string().nullable().optional().describe(
+  action: z5.enum(["list", "create", "update", "delete", "mergePreview", "merge"]).describe("Operation to perform"),
+  projectId: z5.string().optional().describe("Target Conveyor project ID (list/create)"),
+  id: z5.string().optional().describe("Tag ID (update/delete/mergePreview/merge)"),
+  targetTagId: z5.string().optional().describe("Surviving tag ID for mergePreview/merge \u2014 the tag in id is absorbed into this one"),
+  name: z5.string().optional().describe("Tag name"),
+  color: z5.string().optional().describe("Hex color, e.g. #ff0000"),
+  description: z5.string().optional().describe("Tag description \u2014 the \u2264255-char summary"),
+  overview: z5.string().nullable().optional().describe(
     "Full markdown glossary body (update: null clears). Only used on create/update. REJECTED while the tag has an overviewPath \u2014 edit the sourced repo file instead."
   ),
-  overviewPath: z4.string().min(1).max(500).nullable().optional().describe(
+  overviewPath: z5.string().min(1).max(500).nullable().optional().describe(
     "Repo file to source the overview from \u2014 the base-branch content is served everywhere and the stored overview is hidden (update: null clears back to it). A not-yet-merged path is fine: the stored overview serves as fallback (state 'pending') until the file lands. Only used on create/update."
   ),
-  parentTagIds: z4.array(z4.string()).max(25).optional().describe(
+  parentTagIds: z5.array(z5.string()).max(25).optional().describe(
     "Parent tag ids (multi-parent hierarchy). Honored on create; replace-set on update: pass the full list, [] clears."
   ),
-  reason: z4.string().optional().describe("One line on why (update/merge) \u2014 recorded in the tag's revision history"),
-  contextPaths: z4.array(contextPathSchema).max(20).optional().describe(
+  reason: z5.string().optional().describe("One line on why (update/merge) \u2014 recorded in the tag's revision history"),
+  contextPaths: z5.array(contextPathSchema).max(20).optional().describe(
     "Context links (rules/docs/files/folders) auto-loaded into the agent context of cards with this tag. Replace-set: the full list replaces the tag's existing links; pass [] to clear. Only used on create/update."
   )
 };
@@ -1981,13 +2078,13 @@ function registerManagePriorities(server2, conn2) {
     "manage_priorities",
     "List, create, update, or delete project priorities. create requires value (1-100), name, and color; update/delete require the priority id. create/update require a Moderate role; delete requires Admin.",
     {
-      action: z4.enum(["list", "create", "update", "delete"]).describe("Operation to perform"),
-      projectId: z4.string().optional().describe("Target Conveyor project ID (list/create)"),
-      id: z4.string().optional().describe("Priority ID (update/delete)"),
-      value: z4.number().int().min(1).max(100).optional().describe("Priority value (1 = highest urgency scale point)"),
-      name: z4.string().optional().describe("Priority name"),
-      color: z4.string().optional().describe("Hex color, e.g. #ff0000"),
-      description: z4.string().optional().describe("Priority description")
+      action: z5.enum(["list", "create", "update", "delete"]).describe("Operation to perform"),
+      projectId: z5.string().optional().describe("Target Conveyor project ID (list/create)"),
+      id: z5.string().optional().describe("Priority ID (update/delete)"),
+      value: z5.number().int().min(1).max(100).optional().describe("Priority value (1 = highest urgency scale point)"),
+      name: z5.string().optional().describe("Priority name"),
+      color: z5.string().optional().describe("Hex color, e.g. #ff0000"),
+      description: z5.string().optional().describe("Priority description")
     },
     async (params) => {
       const { action, projectId: projectId2, id, value, name, color, description } = params;
@@ -2025,10 +2122,10 @@ function registerListTagAttachments(server2, conn2) {
     "list_tag_attachments",
     "List the files labelled as examples of one tag \u2014 the tag page's Attachments gallery, newest label first. Each tile carries the file's name, mime type, size, a downloadUrl, the card it came from, and the tag's other labels on that file. Only uploaded files appear. The page returns `hasMore` instead of a total: pass offset to read the next page. Tag names come from list_tags, which reports each tag's attachmentCount. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z4.string().optional().describe("Target Conveyor project ID"),
-      tag: z4.string().min(1).max(100).describe("Tag id, or the exact tag name (case-insensitive)"),
-      limit: z4.number().int().min(1).max(60).optional().describe("Tiles per page (default 24)"),
-      offset: z4.number().int().min(0).optional().describe("Tiles to skip (paging). Default 0.")
+      projectId: z5.string().optional().describe("Target Conveyor project ID"),
+      tag: z5.string().min(1).max(100).describe("Tag id, or the exact tag name (case-insensitive)"),
+      limit: z5.number().int().min(1).max(60).optional().describe("Tiles per page (default 24)"),
+      offset: z5.number().int().min(0).optional().describe("Tiles to skip (paging). Default 0.")
     },
     async (params) => jsonResult(await conn2.listTagAttachments(params))
   );
@@ -2043,7 +2140,7 @@ function registerProjectConfigTools(server2, conn2) {
 }
 
 // src/tools/tasks.ts
-import { z as z5 } from "zod";
+import { z as z6 } from "zod";
 
 // src/tools/tasks-format.ts
 var CLI_EVENT_FORMATTERS = {
@@ -2143,10 +2240,10 @@ var STATUS_ENUM2 = [
 ];
 var CARD_TYPE_ENUM = ["task", "incident", "suggestion"];
 var RISK_ENUM2 = ["critical", "high", "medium", "low"];
-var BOARD_FILTER = z5.string().nullable().optional().describe(
+var BOARD_FILTER = z6.string().nullable().optional().describe(
   "Filter to a sub-project board. Omit to use the connection's default board (CONVEYOR_SUBPROJECT_ID) when set, else the whole project; pass null to force the whole project. Use list_accessible_subprojects to find board IDs."
 );
-var BOARD_ASSIGN = z5.string().nullable().optional().describe(
+var BOARD_ASSIGN = z6.string().nullable().optional().describe(
   "Assign the card to a sub-project board. Omit to use the connection's default board (CONVEYOR_SUBPROJECT_ID) when set, else the parent project; pass null to force the parent project. Use list_accessible_subprojects to find board IDs."
 );
 function registerListTasks(server2, conn2) {
@@ -2155,15 +2252,15 @@ function registerListTasks(server2, conn2) {
     "list_tasks",
     "List project cards, optionally filtered by card type, status, or assignment (a specific assignee, or unassigned tasks). Defaults to type=task \u2014 pass typeFilters to list incidents/suggestions. Results are relevance-ordered: highest priority first then newest; suggestions-only queries rank by upvote score. Pass projectId to target a specific project; otherwise the configured default project is used. Returns summaries \u2014 plan omitted, description truncated; use get_task for full details.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      status: z5.enum(STATUS_ENUM2).optional().describe("Filter by task status"),
-      typeFilters: z5.array(z5.enum(CARD_TYPE_ENUM)).optional().describe(
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      status: z6.enum(STATUS_ENUM2).optional().describe("Filter by task status"),
+      typeFilters: z6.array(z6.enum(CARD_TYPE_ENUM)).optional().describe(
         'Card types to include, e.g. ["incident"] or ["task", "incident"]. Omit for tasks only.'
       ),
-      assigneeId: z5.string().optional().describe("Filter by assigned user ID"),
-      unassigned: z5.boolean().optional().describe("Only return tasks with no assignee (mutually exclusive with assigneeId)"),
+      assigneeId: z6.string().optional().describe("Filter by assigned user ID"),
+      unassigned: z6.boolean().optional().describe("Only return tasks with no assignee (mutually exclusive with assigneeId)"),
       subProjectId: BOARD_FILTER,
-      limit: z5.number().optional().describe("Max tasks to return (default 50)")
+      limit: z6.number().optional().describe("Max tasks to return (default 50)")
     },
     async (params) => {
       const tasks = await conn2.listTasks(params);
@@ -2203,8 +2300,8 @@ function registerGetCardBySlug(server2, conn2) {
     "get_card_by_slug",
     'Get full card details by the slug from a card URL (/cards/<slug>) instead of a task ID. Also accepts the board\'s "Copy path" form, `<project-slug>/<card-slug>` \u2014 an embedded project slug wins over projectId and over the configured default. Pass projectId to target a specific project; otherwise the configured default project is used.',
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      slug: z5.string().describe(
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      slug: z6.string().describe(
         "The card slug from a Conveyor card URL, e.g. 'ship-it', or a path-form reference 'my-project/ship-it' (the board's Copy path action)"
       )
     },
@@ -2220,13 +2317,13 @@ function registerCreateTask(server2, conn2) {
     "create_task",
     "Create a new task with title, description, and optional plan. Pass projectId to target a specific project; otherwise the configured default project is used. Icon, story points, and agent assignment are auto-filled when a task is created in (or later moved to) a status beyond Planning \u2014 don't spend turns on them.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      title: z5.string().describe("Task title"),
-      description: z5.string().optional().describe(cardDescriptionDesc("Task description")),
-      plan: z5.string().optional().describe("Task implementation plan (markdown)"),
-      status: z5.enum(["Planning", "Open"]).optional().describe("Initial status (default: Planning)"),
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      title: z6.string().describe("Task title"),
+      description: z6.string().optional().describe(cardDescriptionDesc("Task description")),
+      plan: z6.string().optional().describe("Task implementation plan (markdown)"),
+      status: z6.enum(["Planning", "Open"]).optional().describe("Initial status (default: Planning)"),
       subProjectId: BOARD_ASSIGN,
-      tags: z5.array(z5.string()).optional().describe(
+      tags: z6.array(z6.string()).optional().describe(
         'Tag names to assign to the new card (e.g. ["refactor"]). Unknown names are rejected before the card is created, so nothing is written and a corrected retry creates exactly one card. Create the tag first with manage_tags. Use list_tags to see available tags.'
       )
     },
@@ -2264,9 +2361,9 @@ function registerMoveCard(server2, conn2) {
     "move_card",
     "Move an eligible Planning or Open task, incident, or suggestion card to another project. Cards with identification or automation in progress, active compute, pull requests, deployments, releases, reviews, or delivered reporter email cannot move. Project-specific metadata is cleared instead of mapped by name. Pass projectId for the source project; otherwise the configured default project is used.",
     {
-      projectId: z5.string().optional().describe("Source Conveyor project ID"),
-      taskId: z5.string().describe("Card ID or slug"),
-      destinationProjectId: z5.string().describe("Destination Conveyor project ID")
+      projectId: z6.string().optional().describe("Source Conveyor project ID"),
+      taskId: z6.string().describe("Card ID or slug"),
+      destinationProjectId: z6.string().describe("Destination Conveyor project ID")
     },
     async (params) => {
       const result = await conn2.moveCard(params);
@@ -2315,12 +2412,12 @@ function registerGetTaskCli(server2, conn2) {
     "get_task_logs",
     "Read CLI execution logs from a task. Pass projectId to target a specific project; otherwise the configured default project is used. Returns agent reasoning, tool calls, setup output, and other execution events. For human chat use read_task_chat.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID or slug"),
-      source: z5.enum(["agent", "application"]).optional().describe(
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      taskId: z6.string().describe("The task ID or slug"),
+      source: z6.enum(["agent", "application"]).optional().describe(
         "Filter by log source: 'agent' for reasoning/tool calls, 'application' for setup/dev-server output"
       ),
-      limit: z5.number().optional().describe("Max entries to return (default 50, max 500)")
+      limit: z6.number().optional().describe("Max entries to return (default 50, max 500)")
     },
     async ({ taskId, source, limit, projectId: projectId2 }) => {
       const effectiveLimit = Math.min(limit ?? 50, 500);
@@ -2339,9 +2436,9 @@ function registerGetTaskSessions(server2, conn2) {
     "get_task_sessions",
     "Read compute-session state for a task: legacy CodespaceSession rows plus v3 workspaces, including purpose=review review workspaces. Shows pod identity, liveness, lifecycle, and code-review claim state. Use to diagnose stalled/dead agents or code-review runs. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID or slug"),
-      limit: z5.number().int().min(1).max(200).optional().describe("Max sessions/workspaces listed per task, newest first (default 20)")
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      taskId: z6.string().describe("The task ID or slug"),
+      limit: z6.number().int().min(1).max(200).optional().describe("Max sessions/workspaces listed per task, newest first (default 20)")
     },
     async ({ taskId, projectId: projectId2, limit }) => {
       const tasks = await conn2.getTaskSessions(taskId, projectId2);
@@ -2378,9 +2475,9 @@ function registerReviewTools(server2, conn2) {
     "approve_task",
     "Move a task forward in the review flow (ReviewPR -> ReviewDev, or -> Complete). Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID"),
-      risk: z5.enum(RISK_ENUM2).optional().describe("Optional risk level to record; defaults to a raise-only 'low' on approval.")
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      taskId: z6.string().describe("The task ID"),
+      risk: z6.enum(RISK_ENUM2).optional().describe("Optional risk level to record; defaults to a raise-only 'low' on approval.")
     },
     async (params) => {
       const result = await conn2.approveTask(params.taskId, params.projectId, params.risk);
@@ -2389,19 +2486,27 @@ function registerReviewTools(server2, conn2) {
       };
     }
   );
-  registerContractTool(server2, approveAndMergePrContract, async (params) => {
-    const result = await conn2.approveAndMergePR(params.childTaskId, params.projectId);
-    const text = result.merged ? `PR #${result.prNumber} approved and merged for task ${result.childTaskId}` : `PR #${result.prNumber} approved and QUEUED for merge for task ${result.childTaskId} \u2014 it merges when the CI and code-review gates pass (checked every ~30s). This call did NOT merge it; verify completion via the PR state before depending on it.`;
-    return { content: [{ type: "text", text }] };
-  });
+  server2.tool(
+    "approve_and_merge_pr",
+    "Approve a child task's pull request and QUEUE it for merge \u2014 the merge lands asynchronously (~30s sweep) once the CI and code-review gates pass; the response says whether it merged or was queued, so verify PR state before depending on it. Pass projectId to target a specific project; otherwise the configured default project is used. The child task must be in ReviewPR status with a PR. Requires project Admin, or a sub-project merge grant covering every changed file; release PRs require Admin.",
+    {
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      childTaskId: z6.string().describe("The child task ID whose PR should be approved and merged")
+    },
+    async (params) => {
+      const result = await conn2.approveAndMergePR(params.childTaskId, params.projectId);
+      const text = result.merged ? `PR #${result.prNumber} approved and merged for task ${result.childTaskId}` : `PR #${result.prNumber} approved and QUEUED for merge for task ${result.childTaskId} \u2014 it merges when the CI and code-review gates pass (checked every ~30s). This call did NOT merge it; verify completion via the PR state before depending on it.`;
+      return { content: [{ type: "text", text }] };
+    }
+  );
   server2.tool(
     "request_changes",
     "Post feedback and send task back to InProgress for more work. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID"),
-      feedback: z5.string().describe("Feedback message describing requested changes"),
-      risk: z5.enum(RISK_ENUM2).optional().describe("Optional risk level to record; defaults to a raise-only 'medium' on changes.")
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      taskId: z6.string().describe("The task ID"),
+      feedback: z6.string().describe("Feedback message describing requested changes"),
+      risk: z6.enum(RISK_ENUM2).optional().describe("Optional risk level to record; defaults to a raise-only 'medium' on changes.")
     },
     async (params) => {
       await conn2.requestChanges(params.taskId, params.feedback, params.projectId, params.risk);
@@ -2418,9 +2523,9 @@ function registerReviewerTools(server2, conn2) {
     "add_reviewer",
     "Add a project member as a reviewer on a task. Pass projectId to target a specific project; otherwise the configured default project is used. Idempotent \u2014 adding an existing reviewer is a no-op.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID or slug"),
-      userId: z5.string().describe("User ID of the reviewer (use list_project_members to resolve a name or email)")
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      taskId: z6.string().describe("The task ID or slug"),
+      userId: z6.string().describe("User ID of the reviewer (use list_project_members to resolve a name or email)")
     },
     async (params) => {
       const result = await conn2.addReviewer(params);
@@ -2438,9 +2543,9 @@ function registerReviewerTools(server2, conn2) {
     "remove_reviewer",
     "Remove a reviewer from a task. Pass projectId to target a specific project; otherwise the configured default project is used. Idempotent \u2014 removing a non-reviewer is a no-op.",
     {
-      projectId: z5.string().optional().describe("Target Conveyor project ID"),
-      taskId: z5.string().describe("The task ID or slug"),
-      userId: z5.string().describe("User ID of the reviewer to remove")
+      projectId: z6.string().optional().describe("Target Conveyor project ID"),
+      taskId: z6.string().describe("The task ID or slug"),
+      userId: z6.string().describe("User ID of the reviewer to remove")
     },
     async (params) => {
       const result = await conn2.removeReviewer(params);
@@ -2472,7 +2577,7 @@ function registerTaskTools(server2, conn2) {
 }
 
 // src/tools/builds.ts
-import { z as z6 } from "zod";
+import { z as z7 } from "zod";
 function textResult2(result) {
   return { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] };
 }
@@ -2481,8 +2586,8 @@ function registerTaskLifecycleTools(server2, conn2) {
     "stop_task",
     "Compatibility alias for the legacy stop path. stop_task now performs the same durable sleep behavior as sleep_task, preserving task Claudespace state while stopping compute. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskId: z6.string().describe("The task ID")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskId: z7.string().describe("The task ID")
     },
     async (params) => textResult2(await conn2.sleepTask(params.taskId, params.projectId))
   );
@@ -2490,8 +2595,8 @@ function registerTaskLifecycleTools(server2, conn2) {
     "sleep_task",
     "Sleep a task Claudespace, stopping compute while preserving durable state. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskId: z6.string().describe("The task ID")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskId: z7.string().describe("The task ID")
     },
     async (params) => textResult2(await conn2.sleepTask(params.taskId, params.projectId))
   );
@@ -2499,8 +2604,8 @@ function registerTaskLifecycleTools(server2, conn2) {
     "resume_task",
     "Resume a sleeping task Claudespace. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskId: z6.string().describe("The task ID")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskId: z7.string().describe("The task ID")
     },
     async (params) => textResult2(await conn2.resumeTask(params.taskId, params.projectId))
   );
@@ -2508,8 +2613,8 @@ function registerTaskLifecycleTools(server2, conn2) {
     "delete_task_environment",
     "Delete a task environment, including durable Claudespace state. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskId: z6.string().describe("The task ID")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskId: z7.string().describe("The task ID")
     },
     async (params) => textResult2(await conn2.deleteTaskEnvironment(params.taskId, params.projectId))
   );
@@ -2519,8 +2624,8 @@ function registerBuildTools(server2, conn2) {
     "start_task",
     "Start a cloud build (codespace) for a task. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskId: z6.string().describe("The task ID")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskId: z7.string().describe("The task ID")
     },
     async (params) => {
       const result = await conn2.startBuild(params.taskId, params.projectId);
@@ -2532,8 +2637,8 @@ function registerBuildTools(server2, conn2) {
     "create_release",
     "Create a release for the project \u2014 the same flow as the Release button in the web UI. Pass projectId to target a specific project; otherwise the configured default project is used. Creates a release task with a release/YYYY.MM.N branch and a PR from the dev branch to the default branch. Omit taskIds to release ALL cards currently in Review (Dev); pass a subset to cherry-pick \u2014 a cloud build agent then cherry-picks those changes and resolves conflicts. Fails if a release is already in progress or no cards are in Review (Dev).",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskIds: z6.array(z6.string()).optional().describe(
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskIds: z7.array(z7.string()).optional().describe(
         "Task IDs in Review (Dev) to cherry-pick into the release. Omit to release all of them."
       )
     },
@@ -2546,8 +2651,8 @@ function registerBuildTools(server2, conn2) {
     "add_to_release",
     "Add Review (Dev) cards to the project's pending release \u2014 the same flow as the 'Add to Release' button in the web UI. Pass projectId to target a specific project; otherwise the configured default project is used. Cards must be in Review (Dev) and not already part of another release; the release branch is updated with the latest dev changes. Fails if no release is pending (use create_release instead).",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskIds: z6.array(z6.string()).min(1).describe("Task IDs (not slugs) in Review (Dev) to add to the pending release.")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskIds: z7.array(z7.string()).min(1).describe("Task IDs (not slugs) in Review (Dev) to add to the pending release.")
     },
     async (params) => {
       const result = await conn2.addTasksToRelease(params.taskIds, params.projectId);
@@ -2558,8 +2663,8 @@ function registerBuildTools(server2, conn2) {
     "get_build_status",
     "Check codespace and agent status for a task. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z6.string().optional().describe("Target Conveyor project ID"),
-      taskId: z6.string().describe("The task ID")
+      projectId: z7.string().optional().describe("Target Conveyor project ID"),
+      taskId: z7.string().describe("The task ID")
     },
     async (params) => {
       const status = await conn2.getBuildStatus(params.taskId, params.projectId);
@@ -2571,7 +2676,7 @@ function registerBuildTools(server2, conn2) {
 // src/tools/attachments.ts
 import { readFile, stat } from "fs/promises";
 import { basename, extname } from "path";
-import { z as z7 } from "zod";
+import { z as z8 } from "zod";
 var MAX_FILE_SIZE_BYTES = 25 * 1024 * 1024;
 var MAX_FILE_TAGS = 5;
 var MIME_BY_EXT = {
@@ -2717,10 +2822,10 @@ function registerSetFileTags(server2, conn2) {
     "set_file_tags",
     "Replace the glossary tags on a file that is already uploaded \u2014 the labelling upload_attachment does at upload time, applied to an existing file. Use it to add older attachments to a tag's Attachments gallery, which is what makes a file a visible example of that tagged entity. `tags` is the FULL replacement set: the names you pass become the file's tags and any others are removed, so pass [] to clear every tag. Names are matched case-insensitively within the project; a name that matches no tag is reported back and never fails the tags that did match. Max 5. Call list_task_files for file IDs and list_tags for tag names. Pass projectId to target a specific project; otherwise the configured default project is used.",
     {
-      projectId: z7.string().optional().describe("Target Conveyor project ID"),
-      taskId: z7.string().describe("The task ID or slug the file is attached to"),
-      fileId: z7.string().describe("The file ID to label \u2014 from list_task_files"),
-      tags: z7.array(z7.string().min(1).max(100)).max(MAX_FILE_TAGS).describe(
+      projectId: z8.string().optional().describe("Target Conveyor project ID"),
+      taskId: z8.string().describe("The task ID or slug the file is attached to"),
+      fileId: z8.string().describe("The file ID to label \u2014 from list_task_files"),
+      tags: z8.array(z8.string().min(1).max(100)).max(MAX_FILE_TAGS).describe(
         "Glossary tag names (or ids) the file is an example of. Replaces the file's current tags \u2014 [] clears them. Max 5."
       )
     },
@@ -2949,7 +3054,7 @@ function registerChecklistTools(server2, conn2) {
 }
 
 // src/tools/workspace.ts
-import { z as z8 } from "zod";
+import { z as z9 } from "zod";
 
 // src/workspace-ssh-tunnel.ts
 import net from "net";
@@ -3069,8 +3174,8 @@ function registerAttachInfoTool(server2, conn2) {
     "workspace_attach_info",
     "Return SSH/SFTP attach metadata for a running task Claudespace, plus hosted preview URLs and configured preview ports. Optionally installs an OpenSSH public key for this attach session.",
     {
-      taskId: z8.string().describe("The task ID"),
-      sshPublicKey: z8.string().optional().describe("Optional OpenSSH public key to install into the workspace")
+      taskId: z9.string().describe("The task ID"),
+      sshPublicKey: z9.string().optional().describe("Optional OpenSSH public key to install into the workspace")
     },
     async ({ taskId, sshPublicKey }) => {
       const info = await conn2.getWorkspaceAttachInfo(taskId, sshPublicKey);
@@ -3083,7 +3188,7 @@ function registerPreviewUrlsTool(server2, conn2) {
     "workspace_preview_urls",
     "Return the hosted preview URLs and preview ports for a running task Claudespace. This mirrors the web UI preview link metadata.",
     {
-      taskId: z8.string().describe("The task ID")
+      taskId: z9.string().describe("The task ID")
     },
     async ({ taskId }) => {
       const info = await conn2.getWorkspaceAttachInfo(taskId);
@@ -3112,10 +3217,10 @@ function registerStartTunnelTool(server2, conn2, startTunnel) {
     "workspace_start_tunnel",
     "Start a local loopback tunnel through the MCP server to a running task Claudespace port. Use port 2222 for SSH/SFTP, or one of previewPorts for app access.",
     {
-      taskId: z8.string().describe("The task ID"),
-      port: z8.number().optional().describe("Remote Claudespace port. Defaults to SSH port 2222."),
-      preferredLocalPort: z8.number().optional().describe("Preferred local loopback port. If omitted, the OS chooses one."),
-      sshPublicKey: z8.string().optional().describe("Optional OpenSSH public key to install before opening the tunnel")
+      taskId: z9.string().describe("The task ID"),
+      port: z9.number().optional().describe("Remote Claudespace port. Defaults to SSH port 2222."),
+      preferredLocalPort: z9.number().optional().describe("Preferred local loopback port. If omitted, the OS chooses one."),
+      sshPublicKey: z9.string().optional().describe("Optional OpenSSH public key to install before opening the tunnel")
     },
     async ({ taskId, port, preferredLocalPort, sshPublicKey }) => {
       const info = await conn2.getWorkspaceAttachInfo(taskId, sshPublicKey);
@@ -3175,7 +3280,7 @@ function registerStopTunnelTool(server2) {
     "workspace_stop_tunnel",
     "Stop a local workspace tunnel previously opened by workspace_start_tunnel.",
     {
-      tunnelId: z8.string().describe("Tunnel id returned by workspace_start_tunnel")
+      tunnelId: z9.string().describe("Tunnel id returned by workspace_start_tunnel")
     },
     async ({ tunnelId }) => {
       const tunnel = activeTunnels.get(tunnelId);
@@ -3194,7 +3299,7 @@ function registerWorkspaceTools(server2, conn2, deps = {}) {
 }
 
 // ../shared/dist/index.js
-import { z as z9 } from "zod";
+import { z as z10 } from "zod";
 import { z as z22 } from "zod";
 import { z as z32 } from "zod";
 import { z as z42 } from "zod";
@@ -3203,76 +3308,7 @@ import { z as z62 } from "zod";
 import { z as z72 } from "zod";
 import { z as z82 } from "zod";
 import { z as z92 } from "zod";
-import { z as z10 } from "zod";
-var DEFAULT_SONNET_MODEL = "claude-sonnet-5";
-var DEFAULT_OPUS_MODEL = "claude-opus-5";
-var DEFAULT_HAIKU_MODEL = "claude-haiku-4-5-20251001";
-var FABLE_MODEL = "claude-fable-5-1";
-var PREVIOUS_SONNET_MODEL = "claude-sonnet-4-6";
-var PREVIOUS_OPUS_MODEL = "claude-opus-4-8";
-var PTY_STREAM_PORT_BASE = 7420;
-var PTY_STREAM_PORT_ATTEMPTS = 8;
-var PREVIEW_PORT_DENY_LIST = [
-  5432,
-  6379,
-  9200,
-  ...Array.from({ length: PTY_STREAM_PORT_ATTEMPTS }, (_, i) => PTY_STREAM_PORT_BASE + i)
-];
-function normalizeCheckpointPath(value) {
-  let normalized = value.trim().replace(/\/{2,}/g, "/");
-  normalized = normalized.split("/").filter((segment) => segment !== ".").join("/");
-  while (normalized.endsWith("/")) normalized = normalized.slice(0, -1);
-  return normalized;
-}
-var checkpointPathSchema = z9.string().transform(normalizeCheckpointPath).pipe(
-  z9.string().min(1).refine((value) => value !== ".", "Checkpoint paths must name a repository entry").refine((value) => !value.startsWith("/"), "Checkpoint paths must be repository-relative").refine(
-    (value) => !/^[A-Za-z]:[\\/]/.test(value) && !value.includes("\\"),
-    "Checkpoint paths must use repository-relative POSIX syntax"
-  ).refine(
-    (value) => !value.split("/").includes(".."),
-    "Checkpoint paths must not traverse a parent directory"
-  )
-);
-var secretNameSchema = z9.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/);
-var checkpointKeySchema = z9.string().regex(/^[0-9a-f]{64}$/);
-var checkpointDigestRefSchema = z9.string().regex(/^[^\s@]+@sha256:[0-9a-f]{64}$/);
-var ACTIONS_PREBAKE_REGISTRY_PATTERN = /^[a-z0-9](?:[a-z0-9.-]*[a-z0-9])?(?::(?:[1-9][0-9]{0,4}))?(?:\/[a-z0-9]+(?:[._-][a-z0-9]+)*)*$/;
-var actionsPrebakeRegistrySchema = z9.string().trim().min(1).regex(
-  ACTIONS_PREBAKE_REGISTRY_PATTERN,
-  "Actions prebake registry must be a lowercase host[:port] with an optional path prefix"
-).refine((value) => {
-  const port = /:([0-9]+)(?:\/|$)/.exec(value)?.[1];
-  return !port || Number(port) <= 65535;
-}, "Actions prebake registry port must be between 1 and 65535");
-function uniqueSortedArray(item, minimum = 0) {
-  return z9.array(item).min(minimum).superRefine((values, ctx) => {
-    if (new Set(values).size !== values.length) {
-      ctx.addIssue({ code: z9.ZodIssueCode.custom, message: "Duplicate values are not allowed" });
-    }
-  }).transform((values) => [...values].sort());
-}
-var projectCheckpointSettingsSchema = z9.object({
-  enabled: z9.literal(true),
-  cacheCommand: z9.string().trim().min(1),
-  cacheInputPaths: uniqueSortedArray(checkpointPathSchema, 1),
-  reusableArtifactPaths: uniqueSortedArray(checkpointPathSchema, 1),
-  finalizeCommand: z9.string().trim().min(1),
-  credentialEpoch: z9.string().trim().min(1),
-  requiredSecretNames: uniqueSortedArray(secretNameSchema).optional(),
-  optionalSecretNames: uniqueSortedArray(secretNameSchema).optional(),
-  bakeWebAppBuild: z9.boolean().optional()
-}).superRefine((checkpoint, ctx) => {
-  const required = new Set(checkpoint.requiredSecretNames ?? []);
-  for (const name of checkpoint.optionalSecretNames ?? []) {
-    if (required.has(name)) {
-      ctx.addIssue({
-        code: z9.ZodIssueCode.custom,
-        path: ["optionalSecretNames"],
-        message: "A secret cannot be both required and optional"
-      });
-    }
-  }
-});
+import { z as z102 } from "zod";
 var ACHIEVEMENT_RARITIES = [
   {
     key: "common",
@@ -3296,7 +3332,7 @@ var ACHIEVEMENT_RARITIES = [
   { key: "pack", name: "Pack", color: "#9c27b0", iconPath: "/storypoints/pack.svg" }
 ];
 var RISK_LEVELS = ["critical", "high", "medium", "low"];
-var riskLevelSchema = z22.enum(RISK_LEVELS);
+var riskLevelSchema = z10.enum(RISK_LEVELS);
 var DEFAULT_RISK_LEVELS = [
   {
     level: "critical",
@@ -3350,168 +3386,168 @@ var MAX_FILE_TAG_LENGTH = 100;
 var EMBED_THRESHOLD_IMAGES = 5 * 1024 * 1024;
 var EMBED_THRESHOLD_TEXT = 2 * 1024 * 1024;
 var IDLE_HEARTBEAT_MS = 90 * 1e3;
-var TurnEndToolCallSchema = z32.object({
-  tool: z32.string(),
-  input: z32.string().optional(),
-  output: z32.string().optional(),
-  timestamp: z32.string().optional()
+var TurnEndToolCallSchema = z22.object({
+  tool: z22.string(),
+  input: z22.string().optional(),
+  output: z22.string().optional(),
+  timestamp: z22.string().optional()
 }).passthrough();
-var KnownAgentEventSchema = z32.discriminatedUnion("type", [
+var KnownAgentEventSchema = z22.discriminatedUnion("type", [
   // ── Lifecycle / connection ────────────────────────────────────────────
-  z32.object({
-    type: z32.literal("connected"),
-    sessionId: z32.string(),
-    projectId: z32.string().optional()
+  z22.object({
+    type: z22.literal("connected"),
+    sessionId: z22.string(),
+    projectId: z22.string().optional()
   }).passthrough(),
   // Open-ended context snapshot spread from buildInitializationContext().
-  z32.object({ type: z32.literal("session_manifest") }).passthrough(),
-  z32.object({
-    type: z32.literal("agent_runner_status"),
-    reason: z32.string(),
-    attempt: z32.number().optional(),
-    attempts: z32.number().optional()
+  z22.object({ type: z22.literal("session_manifest") }).passthrough(),
+  z22.object({
+    type: z22.literal("agent_runner_status"),
+    reason: z22.string(),
+    attempt: z22.number().optional(),
+    attempts: z22.number().optional()
   }).passthrough(),
-  z32.object({ type: z32.literal("shutdown"), reason: z32.string().optional() }).passthrough(),
-  z32.object({ type: z32.literal("mode_changed"), agentMode: z32.string() }).passthrough(),
-  z32.object({ type: z32.literal("mode_transition"), from: z32.string(), to: z32.string() }).passthrough(),
+  z22.object({ type: z22.literal("shutdown"), reason: z22.string().optional() }).passthrough(),
+  z22.object({ type: z22.literal("mode_changed"), agentMode: z22.string() }).passthrough(),
+  z22.object({ type: z22.literal("mode_transition"), from: z22.string(), to: z22.string() }).passthrough(),
   // ── Turn stream ───────────────────────────────────────────────────────
-  z32.object({ type: z32.literal("message"), content: z32.string() }).passthrough(),
-  z32.object({ type: z32.literal("thinking"), message: z32.string() }).passthrough(),
-  z32.object({
-    type: z32.literal("tool_use"),
-    tool: z32.string(),
+  z22.object({ type: z22.literal("message"), content: z22.string() }).passthrough(),
+  z22.object({ type: z22.literal("thinking"), message: z22.string() }).passthrough(),
+  z22.object({
+    type: z22.literal("tool_use"),
+    tool: z22.string(),
     // Producers send JSON.stringify(input); consumers defend against
     // object inputs from older agents, so the wire stays permissive here.
-    input: z32.unknown().optional()
+    input: z22.unknown().optional()
   }).passthrough(),
-  z32.object({
-    type: z32.literal("tool_result"),
-    tool: z32.string(),
-    output: z32.unknown().optional(),
-    isError: z32.boolean().optional(),
-    redactedCount: z32.number().optional()
+  z22.object({
+    type: z22.literal("tool_result"),
+    tool: z22.string(),
+    output: z22.unknown().optional(),
+    isError: z22.boolean().optional(),
+    redactedCount: z22.number().optional()
   }).passthrough(),
-  z32.object({ type: z32.literal("turn_end"), toolCalls: z32.array(TurnEndToolCallSchema) }).passthrough(),
-  z32.object({
-    type: z32.literal("completed"),
-    summary: z32.string().optional(),
-    durationMs: z32.number().optional()
+  z22.object({ type: z22.literal("turn_end"), toolCalls: z22.array(TurnEndToolCallSchema) }).passthrough(),
+  z22.object({
+    type: z22.literal("completed"),
+    summary: z22.string().optional(),
+    durationMs: z22.number().optional()
   }).passthrough(),
-  z32.object({ type: z32.literal("error"), message: z32.string() }).passthrough(),
-  z32.object({ type: z32.literal("agent_typing_start") }).passthrough(),
-  z32.object({ type: z32.literal("agent_typing_stop") }).passthrough(),
+  z22.object({ type: z22.literal("error"), message: z22.string() }).passthrough(),
+  z22.object({ type: z22.literal("agent_typing_start") }).passthrough(),
+  z22.object({ type: z22.literal("agent_typing_stop") }).passthrough(),
   // ── Telemetry ─────────────────────────────────────────────────────────
   // heartbeat/typing: legacy telemetry the server still classifies as
   // transient (TRANSIENT_EVENT_TYPES) — kept in the vocabulary.
-  z32.object({ type: z32.literal("heartbeat") }).passthrough(),
-  z32.object({ type: z32.literal("typing") }).passthrough(),
-  z32.object({
-    type: z32.literal("context_update"),
-    contextTokens: z32.number(),
-    contextWindow: z32.number(),
-    inputTokens: z32.number().optional(),
-    cacheReadInputTokens: z32.number().optional(),
-    cacheCreationInputTokens: z32.number().optional(),
-    totalTokensUsed: z32.number().optional()
+  z22.object({ type: z22.literal("heartbeat") }).passthrough(),
+  z22.object({ type: z22.literal("typing") }).passthrough(),
+  z22.object({
+    type: z22.literal("context_update"),
+    contextTokens: z22.number(),
+    contextWindow: z22.number(),
+    inputTokens: z22.number().optional(),
+    cacheReadInputTokens: z22.number().optional(),
+    cacheCreationInputTokens: z22.number().optional(),
+    totalTokensUsed: z22.number().optional()
   }).passthrough(),
   // Four producer shapes share this type: {rateLimitType, utilization, status}
   // (SDK rate_limit_event), {resetsAt} (agent-connection resume notice), the
   // usage-sampler ({rateLimitType, utilization, status, resetsAt, gauges}
   // — resetsAt matches rateLimitType; gauges survives via .passthrough()), and
   // {unmeasurable, reason} (the sampler reporting it cannot read this key).
-  z32.object({
-    type: z32.literal("rate_limit_update"),
-    rateLimitType: z32.string().optional(),
-    utilization: z32.number().optional(),
-    status: z32.string().optional(),
-    resetsAt: z32.string().optional(),
-    unmeasurable: z32.boolean().optional(),
-    reason: z32.string().optional()
+  z22.object({
+    type: z22.literal("rate_limit_update"),
+    rateLimitType: z22.string().optional(),
+    utilization: z22.number().optional(),
+    status: z22.string().optional(),
+    resetsAt: z22.string().optional(),
+    unmeasurable: z22.boolean().optional(),
+    reason: z22.string().optional()
   }).passthrough(),
-  z32.object({
-    type: z32.literal("context_compacted"),
-    trigger: z32.string().optional(),
-    preTokens: z32.number().optional()
+  z22.object({
+    type: z22.literal("context_compacted"),
+    trigger: z22.string().optional(),
+    preTokens: z22.number().optional()
   }).passthrough(),
-  z32.object({
-    type: z32.literal("tool_progress"),
-    toolName: z32.string().optional(),
-    elapsedSeconds: z32.number().optional()
+  z22.object({
+    type: z22.literal("tool_progress"),
+    toolName: z22.string().optional(),
+    elapsedSeconds: z22.number().optional()
   }).passthrough(),
-  z32.object({
-    type: z32.literal("subagent_started"),
-    sdkTaskId: z32.string().optional(),
-    description: z32.string().optional()
+  z22.object({
+    type: z22.literal("subagent_started"),
+    sdkTaskId: z22.string().optional(),
+    description: z22.string().optional()
   }).passthrough(),
-  z32.object({
-    type: z32.literal("subagent_progress"),
-    sdkTaskId: z32.string().optional(),
-    description: z32.string().optional(),
-    toolUses: z32.number().optional(),
-    durationMs: z32.number().optional()
+  z22.object({
+    type: z22.literal("subagent_progress"),
+    sdkTaskId: z22.string().optional(),
+    description: z22.string().optional(),
+    toolUses: z22.number().optional(),
+    durationMs: z22.number().optional()
   }).passthrough(),
   // ── Work products ─────────────────────────────────────────────────────
-  z32.object({ type: z32.literal("pr_created"), url: z32.string(), number: z32.number() }).passthrough(),
-  z32.object({
-    type: z32.literal("code_review_complete"),
-    result: z32.enum(["approved", "changes_requested"]),
-    summary: z32.string().optional(),
-    issues: z32.array(
-      z32.object({
-        file: z32.string(),
-        line: z32.number().optional(),
-        severity: z32.string().optional(),
-        description: z32.string().optional()
+  z22.object({ type: z22.literal("pr_created"), url: z22.string(), number: z22.number() }).passthrough(),
+  z22.object({
+    type: z22.literal("code_review_complete"),
+    result: z22.enum(["approved", "changes_requested"]),
+    summary: z22.string().optional(),
+    issues: z22.array(
+      z22.object({
+        file: z22.string(),
+        line: z22.number().optional(),
+        severity: z22.string().optional(),
+        description: z22.string().optional()
       }).passthrough()
     ).optional()
   }).passthrough(),
   // ── Environment setup / start command ─────────────────────────────────
-  z32.object({ type: z32.literal("setup_output"), stream: z32.string(), data: z32.string() }).passthrough(),
-  z32.object({
-    type: z32.literal("setup_complete"),
-    startCommandRunning: z32.boolean().optional(),
-    startCommandConfigured: z32.boolean().optional(),
+  z22.object({ type: z22.literal("setup_output"), stream: z22.string(), data: z22.string() }).passthrough(),
+  z22.object({
+    type: z22.literal("setup_complete"),
+    startCommandRunning: z22.boolean().optional(),
+    startCommandConfigured: z22.boolean().optional(),
     // Sanitized server-side by sanitizeSessionPreviewPorts — stays unknown.
-    previewPorts: z32.unknown().optional()
+    previewPorts: z22.unknown().optional()
   }).passthrough(),
-  z32.object({ type: z32.literal("setup_error"), message: z32.string() }).passthrough(),
-  z32.object({ type: z32.literal("start_command_started") }).passthrough(),
-  z32.object({ type: z32.literal("start_command_output"), stream: z32.string(), data: z32.string() }).passthrough(),
-  z32.object({
-    type: z32.literal("start_command_exited"),
-    code: z32.number().nullable().optional(),
-    signal: z32.string().nullable().optional(),
-    message: z32.string().optional()
+  z22.object({ type: z22.literal("setup_error"), message: z22.string() }).passthrough(),
+  z22.object({ type: z22.literal("start_command_started") }).passthrough(),
+  z22.object({ type: z22.literal("start_command_output"), stream: z22.string(), data: z22.string() }).passthrough(),
+  z22.object({
+    type: z22.literal("start_command_exited"),
+    code: z22.number().nullable().optional(),
+    signal: z22.string().nullable().optional(),
+    message: z22.string().optional()
   }).passthrough(),
-  z32.object({ type: z32.literal("start_command_error"), message: z32.string() }).passthrough()
+  z22.object({ type: z22.literal("start_command_error"), message: z22.string() }).passthrough()
 ]);
-var AgentEventSchema = z32.union([
+var AgentEventSchema = z22.union([
   KnownAgentEventSchema,
-  z32.object({ type: z32.string().min(1) }).catchall(z32.unknown())
+  z22.object({ type: z22.string().min(1) }).catchall(z22.unknown())
 ]);
-var cardDescription = z42.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
-var AgentHeartbeatSchema = z42.object({
-  sessionId: z42.string().optional(),
-  timestamp: z42.string(),
-  status: z42.enum(["active", "idle", "building"]),
-  currentAction: z42.string().optional(),
+var cardDescription = z32.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
+var AgentHeartbeatSchema = z32.object({
+  sessionId: z32.string().optional(),
+  timestamp: z32.string(),
+  status: z32.enum(["active", "idle", "building"]),
+  currentAction: z32.string().optional(),
   /** Sender-observed main event-loop lag (ms) — see AgentHeartbeat.loopLagMs. */
-  loopLagMs: z42.number().nonnegative().optional()
-});
-var CreatePRInputSchema = z42.object({
-  title: z42.string().min(1),
-  body: z42.string(),
-  head: z42.string().optional(),
-  base: z42.string().optional()
-});
-var PostToChatInputSchema = z42.object({
-  message: z42.string().min(1),
-  type: z42.enum(["message", "question", "update"]).optional().default("message"),
-  milestone: z42.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
-});
-var GetTaskContextRequestSchema = z42.object({
-  sessionId: z42.string(),
-  includeHistory: z42.boolean().optional().default(false),
+  loopLagMs: z32.number().nonnegative().optional()
+});
+var CreatePRInputSchema = z32.object({
+  title: z32.string().min(1),
+  body: z32.string(),
+  head: z32.string().optional(),
+  base: z32.string().optional()
+});
+var PostToChatInputSchema = z32.object({
+  message: z32.string().min(1),
+  type: z32.enum(["message", "question", "update"]).optional().default("message"),
+  milestone: z32.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
+});
+var GetTaskContextRequestSchema = z32.object({
+  sessionId: z32.string(),
+  includeHistory: z32.boolean().optional().default(false),
   /**
    * Read the plan-revised marker WITHOUT consuming it. Bookkeeping fetches
    * (the session-identity check, the branch refresh) pass true so they cannot
@@ -3519,277 +3555,277 @@ var GetTaskContextRequestSchema = z42.object({
    * Defaults to false — consuming — so a pod running an older agent build still
    * clears the marker instead of showing the notice on every boot forever.
    */
-  peekPlanRevision: z42.boolean().optional().default(false)
+  peekPlanRevision: z32.boolean().optional().default(false)
 });
-var GetChatMessagesRequestSchema = z42.object({
-  sessionId: z42.string(),
-  limit: z42.number().int().positive().optional().default(50),
-  offset: z42.number().int().nonnegative().optional().default(0),
+var GetChatMessagesRequestSchema = z32.object({
+  sessionId: z32.string(),
+  limit: z32.number().int().positive().optional().default(50),
+  offset: z32.number().int().nonnegative().optional().default(0),
   /** Task id or slug to read chat from. Omit for the session's own task. Only
    * the session's own task or one of its children resolves — anything else is
    * an error, never a silent fallback to the caller's own chat. */
-  taskId: z42.string().optional()
+  taskId: z32.string().optional()
 });
-var GetTaskFilesRequestSchema = z42.object({
-  sessionId: z42.string()
+var GetTaskFilesRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var GetTaskFileRequestSchema = z42.object({
-  sessionId: z42.string(),
-  fileId: z42.string()
+var GetTaskFileRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string()
 });
-var GetTaskRequestSchema = z42.object({
-  sessionId: z42.string(),
-  taskSlugOrId: z42.string()
+var GetTaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  taskSlugOrId: z32.string()
 });
-var GetCliHistoryRequestSchema = z42.object({
-  sessionId: z42.string(),
-  limit: z42.number().int().positive().optional().default(100),
-  source: z42.enum(["agent", "application"]).optional(),
+var GetCliHistoryRequestSchema = z32.object({
+  sessionId: z32.string(),
+  limit: z32.number().int().positive().optional().default(100),
+  source: z32.enum(["agent", "application"]).optional(),
   /** Task id or slug to read logs from. Omit for the session's own task. Only
    * the session's own task or one of its children resolves — anything else is
    * an error, never a silent fallback to the caller's own logs. */
-  taskId: z42.string().optional()
+  taskId: z32.string().optional()
 });
-var ListSubtasksRequestSchema = z42.object({
-  sessionId: z42.string(),
-  /** "compact" returns the slim orchestration view (ListSubtasksCompactResponse)
-   * with the pack build-slot picture; "full" (default — wire-compat with older
+var ListSubtasksRequestSchema = z32.object({
+  sessionId: z32.string(),
+  /** "compact" returns the slim orchestration view (ListSubtasksCompactResponse:
+   * per-child status, agent, story points, PR state, dependencies); "full" (default — wire-compat with older
    * agents) returns the verbose SubtaskSummaryDTO[] including description/plan. */
-  view: z42.enum(["compact", "full"]).optional()
-});
-var GetDependenciesRequestSchema = z42.object({
-  sessionId: z42.string()
-});
-var GetSuggestionsRequestSchema = z42.object({
-  sessionId: z42.string(),
-  status: z42.string().optional(),
-  limit: z42.number().int().min(1).max(100).optional()
-});
-var ListManualTestsRequestSchema = z42.object({
-  sessionId: z42.string()
-});
-var QueryManualTestsRequestSchema = z42.object({
-  sessionId: z42.string(),
-  cardStatuses: z42.array(z42.string()).optional(),
-  testStatuses: z42.array(z42.enum(["open", "approved", "rejected"])).optional()
-});
-var CreatePullRequestRequestSchema = CreatePRInputSchema.extend({ sessionId: z42.string() });
-var RequestFileUploadRequestSchema = z42.object({
-  sessionId: z42.string(),
-  fileName: z42.string().min(1).max(255),
-  mimeType: z42.string().min(1).max(128),
-  fileSize: z42.number().int().positive().max(MAX_FILE_SIZE_BYTES2)
-});
-var ConfirmFileUploadRequestSchema = z42.object({
-  sessionId: z42.string(),
-  fileId: z42.string(),
-  title: z42.string().max(500).optional(),
+  view: z32.enum(["compact", "full"]).optional()
+});
+var GetDependenciesRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var GetSuggestionsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  status: z32.string().optional(),
+  limit: z32.number().int().min(1).max(100).optional()
+});
+var ListManualTestsRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var QueryManualTestsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  cardStatuses: z32.array(z32.string()).optional(),
+  testStatuses: z32.array(z32.enum(["open", "approved", "rejected"])).optional()
+});
+var CreatePullRequestRequestSchema = CreatePRInputSchema.extend({ sessionId: z32.string() });
+var RequestFileUploadRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileName: z32.string().min(1).max(255),
+  mimeType: z32.string().min(1).max(128),
+  fileSize: z32.number().int().positive().max(MAX_FILE_SIZE_BYTES2)
+});
+var ConfirmFileUploadRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fileId: z32.string(),
+  title: z32.string().max(500).optional(),
   /** Glossary tag names (or ids) this file is an example of. */
-  tags: z42.array(z42.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS2).optional()
-});
-var UpdateTaskStatusRequestSchema = z42.object({
-  sessionId: z42.string(),
-  status: z42.string(),
-  force: z42.boolean().optional().default(false)
-});
-var StoreSessionIdRequestSchema = z42.object({
-  sessionId: z42.string(),
-  sdkSessionId: z42.string()
-});
-var SetManualTestsRequestSchema = z42.object({
-  sessionId: z42.string(),
-  items: z42.array(z42.object({ title: z42.string().min(1) })).min(1)
-});
-var EditManualTestRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1),
-  newTitle: z42.string().min(1)
-});
-var RemoveManualTestRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1)
-});
-var ApproveManualTestRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1)
-});
-var RejectManualTestRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1),
-  reason: z42.string().min(1).max(2e3)
-});
-var SessionStartRequestSchema = z42.object({
-  sessionId: z42.string(),
-  agentVersion: z42.string(),
-  capabilities: z42.array(z42.string())
-});
-var SessionStopRequestSchema = z42.object({
-  sessionId: z42.string(),
-  reason: z42.string().optional()
-});
-var EndReviewSessionRequestSchema = z42.object({
-  sessionId: z42.string(),
-  reason: z42.enum(["approved", "changes_requested", "finished"]).optional()
-});
-var ConnectAgentRequestSchema = z42.object({
-  sessionId: z42.string()
-});
-var ReportAgentStatusRequestSchema = z42.object({
-  sessionId: z42.string(),
-  status: z42.string(),
+  tags: z32.array(z32.string().min(1).max(MAX_FILE_TAG_LENGTH)).max(MAX_FILE_TAGS2).optional()
+});
+var UpdateTaskStatusRequestSchema = z32.object({
+  sessionId: z32.string(),
+  status: z32.string(),
+  force: z32.boolean().optional().default(false)
+});
+var StoreSessionIdRequestSchema = z32.object({
+  sessionId: z32.string(),
+  sdkSessionId: z32.string()
+});
+var SetManualTestsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  items: z32.array(z32.object({ title: z32.string().min(1) })).min(1)
+});
+var EditManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
+  newTitle: z32.string().min(1)
+});
+var RemoveManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1)
+});
+var ApproveManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1)
+});
+var RejectManualTestRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
+  reason: z32.string().min(1).max(2e3)
+});
+var SessionStartRequestSchema = z32.object({
+  sessionId: z32.string(),
+  agentVersion: z32.string(),
+  capabilities: z32.array(z32.string())
+});
+var SessionStopRequestSchema = z32.object({
+  sessionId: z32.string(),
+  reason: z32.string().optional()
+});
+var EndReviewSessionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  reason: z32.enum(["approved", "changes_requested", "finished"]).optional()
+});
+var ConnectAgentRequestSchema = z32.object({
+  sessionId: z32.string()
+});
+var ReportAgentStatusRequestSchema = z32.object({
+  sessionId: z32.string(),
+  status: z32.string(),
   /** Why the agent reports this status (e.g. "user_question" while an AskUserQuestion questionnaire is pending in the TUI). */
-  reason: z42.string().optional(),
+  reason: z32.string().optional(),
   /**
    * The pending question text, sent only alongside `reason: "user_question"`
    * so the server can surface it in the user-question notification body (and
    * thus the Attention feed) instead of a generic string. Optional: older
    * agents omit it and the server falls back to the generic wording.
    */
-  questionText: z42.string().optional()
+  questionText: z32.string().optional()
 });
-var NotifyAgentVersionRequestSchema = z42.object({
-  sessionId: z42.string(),
-  agentVersion: z42.string()
+var NotifyAgentVersionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  agentVersion: z32.string()
 });
-var DiscoveredPortSchema = z42.object({
-  port: z42.number().int().min(1).max(65535),
-  label: z42.string().min(1).max(64).optional(),
-  protocol: z42.enum(["http", "tcp"]).optional(),
-  detectedAt: z42.string()
+var DiscoveredPortSchema = z32.object({
+  port: z32.number().int().min(1).max(65535),
+  label: z32.string().min(1).max(64).optional(),
+  protocol: z32.enum(["http", "tcp"]).optional(),
+  detectedAt: z32.string()
 });
-var ReportDiscoveredPortsRequestSchema = z42.object({
-  sessionId: z42.string(),
-  ports: z42.array(DiscoveredPortSchema).max(64)
+var ReportDiscoveredPortsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  ports: z32.array(DiscoveredPortSchema).max(64)
 });
-var ReportBootMilestoneRequestSchema = z42.object({
-  sessionId: z42.string(),
-  key: z42.string().max(64)
+var ReportBootMilestoneRequestSchema = z32.object({
+  sessionId: z32.string(),
+  key: z32.string().max(64)
 });
-var CreateSubtaskRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1),
+var CreateSubtaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
   description: cardDescription,
-  plan: z42.string().optional(),
-  storyPointValue: z42.number().int().positive().optional(),
-  ordinal: z42.number().int().nonnegative().optional(),
-  followParentStatus: z42.boolean().optional(),
+  plan: z32.string().optional(),
+  storyPointValue: z32.number().int().positive().optional(),
+  ordinal: z32.number().int().nonnegative().optional(),
+  followParentStatus: z32.boolean().optional(),
   /** Sibling subtask ids or slugs this subtask blocks on (explicit dependency
    * metadata — preferred over encoding order in plan text / ordinal). */
-  dependsOn: z42.array(z42.string().min(1)).max(32).optional(),
+  dependsOn: z32.array(z32.string().min(1)).max(32).optional(),
   /** Glossary tag names to assign to the child. Unmatched names come back in
    * the response rather than failing the create. */
-  tags: z42.array(z42.string().min(1)).max(10).optional()
+  tags: z32.array(z32.string().min(1)).max(10).optional()
 });
-var UpdateSubtaskRequestSchema = z42.object({
-  sessionId: z42.string(),
-  subtaskId: z42.string(),
-  title: z42.string().min(1).optional(),
+var UpdateSubtaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  subtaskId: z32.string(),
+  title: z32.string().min(1).optional(),
   description: cardDescription,
-  plan: z42.string().optional(),
+  plan: z32.string().optional(),
   /** Orchestration statuses only ("Planning" | "Open") — the pack parent's
    * sanctioned promotion path. Execution statuses stay with the build
    * pipeline / force_update_task_status. Enforced server-side. */
-  status: z42.string().optional(),
+  status: z32.string().optional(),
   /** Assign a project agent to the child — accepts the agent's id or exact
    * name; resolved against the parent task's project server-side. */
-  agentIdOrName: z42.string().min(1).optional(),
-  storyPointValue: z42.number().int().positive().optional(),
-  followParentStatus: z42.boolean().optional(),
+  agentIdOrName: z32.string().min(1).optional(),
+  storyPointValue: z32.number().int().positive().optional(),
+  followParentStatus: z32.boolean().optional(),
   /** Replace this subtask's dependency edges with these sibling ids/slugs.
    * Empty array clears all. Omit to leave dependencies unchanged. */
-  dependsOn: z42.array(z42.string().min(1)).max(32).optional()
+  dependsOn: z32.array(z32.string().min(1)).max(32).optional()
 });
-var DeleteSubtaskRequestSchema = z42.object({
-  sessionId: z42.string(),
-  subtaskId: z42.string()
+var DeleteSubtaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  subtaskId: z32.string()
 });
-var SetSubtaskParentRequestSchema = z42.object({
-  sessionId: z42.string(),
-  taskId: z42.string().min(1),
-  detach: z42.boolean().optional(),
-  ordinal: z42.number().int().nonnegative().optional(),
-  followParentStatus: z42.boolean().optional()
+var SetSubtaskParentRequestSchema = z32.object({
+  sessionId: z32.string(),
+  taskId: z32.string().min(1),
+  detach: z32.boolean().optional(),
+  ordinal: z32.number().int().nonnegative().optional(),
+  followParentStatus: z32.boolean().optional()
 });
-var GetTaskPropertiesRequestSchema = z42.object({
-  sessionId: z42.string()
+var GetTaskPropertiesRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var UpdateTaskFieldsRequestSchema = z42.object({
-  sessionId: z42.string(),
-  plan: z42.string().optional(),
+var UpdateTaskFieldsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  plan: z32.string().optional(),
   description: cardDescription
 });
-var UpdateTaskPropertiesRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().optional(),
-  storyPointValue: z42.number().int().positive().optional(),
-  tagIds: z42.array(z42.string()).optional(),
-  tagNames: z42.array(z42.string()).optional(),
-  githubPRUrl: z42.string().url().optional(),
-  githubBranch: z42.string().optional(),
+var UpdateTaskPropertiesRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().optional(),
+  storyPointValue: z32.number().int().positive().optional(),
+  tagIds: z32.array(z32.string()).optional(),
+  tagNames: z32.array(z32.string()).optional(),
+  githubPRUrl: z32.string().url().optional(),
+  githubBranch: z32.string().optional(),
   // Canonical risk level, or null to clear — same semantics as the headless
   // update_task boundary (resolved to the project's Risk row in the handler).
   risk: riskLevelSchema.nullable().optional()
 });
-var ListIconsRequestSchema = z42.object({
-  sessionId: z42.string()
+var ListIconsRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var GenerateTaskIconRequestSchema = z42.object({
-  sessionId: z42.string(),
-  prompt: z42.string().min(1),
-  aspectRatio: z42.string().optional()
+var GenerateTaskIconRequestSchema = z32.object({
+  sessionId: z32.string(),
+  prompt: z32.string().min(1),
+  aspectRatio: z32.string().optional()
 });
-var SearchFaIconsRequestSchema = z42.object({
-  sessionId: z42.string(),
-  query: z42.string().min(1),
-  first: z42.number().int().positive().optional()
+var SearchFaIconsRequestSchema = z32.object({
+  sessionId: z32.string(),
+  query: z32.string().min(1),
+  first: z32.number().int().positive().optional()
 });
-var PickFaIconRequestSchema = z42.object({
-  sessionId: z42.string(),
-  fontAwesomeId: z42.string().min(1),
-  fontAwesomeStyle: z42.string().optional()
+var PickFaIconRequestSchema = z32.object({
+  sessionId: z32.string(),
+  fontAwesomeId: z32.string().min(1),
+  fontAwesomeStyle: z32.string().optional()
 });
-var CreateFollowUpTaskRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1),
+var CreateFollowUpTaskRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
   description: cardDescription,
-  plan: z42.string().optional(),
-  storyPointValue: z42.number().int().positive().optional()
+  plan: z32.string().optional(),
+  storyPointValue: z32.number().int().positive().optional()
 });
-var AddDependencyRequestSchema = z42.object({
-  sessionId: z42.string(),
-  dependsOnSlugOrId: z42.string()
+var AddDependencyRequestSchema = z32.object({
+  sessionId: z32.string(),
+  dependsOnSlugOrId: z32.string()
 });
-var RemoveDependencyRequestSchema = z42.object({
-  sessionId: z42.string(),
-  dependsOnSlugOrId: z42.string()
+var RemoveDependencyRequestSchema = z32.object({
+  sessionId: z32.string(),
+  dependsOnSlugOrId: z32.string()
 });
-var CreateSuggestionRequestSchema = z42.object({
-  sessionId: z42.string(),
-  title: z42.string().min(1),
+var CreateSuggestionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  title: z32.string().min(1),
   description: cardDescription,
-  tagNames: z42.array(z42.string()).optional()
+  tagNames: z32.array(z32.string()).optional()
 });
-var VoteSuggestionRequestSchema = z42.object({
-  sessionId: z42.string(),
-  suggestionId: z42.string(),
-  value: z42.union([z42.literal(1), z42.literal(-1)])
+var VoteSuggestionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  suggestionId: z32.string(),
+  value: z32.union([z32.literal(1), z32.literal(-1)])
 });
-var TriggerIdentificationRequestSchema = z42.object({
-  sessionId: z42.string()
+var TriggerIdentificationRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var HandoffToImplementerRequestSchema = z42.object({
-  sessionId: z42.string(),
+var HandoffToImplementerRequestSchema = z32.object({
+  sessionId: z32.string(),
   // Optional difficulty sizing — sets the task's story points before resolving
   // the matched implementer agent. Omit to hand off using the task's current
   // story points (or the project's default task agent when unsized).
-  storyPoints: z42.number().int().positive().optional(),
+  storyPoints: z32.number().int().positive().optional(),
   // Optional kickoff note posted to the task chat alongside the handoff notice.
-  message: z42.string().optional()
+  message: z32.string().optional()
 });
-var SubmitCodeReviewResultRequestSchema = z42.object({
-  sessionId: z42.string(),
-  approved: z42.boolean(),
-  content: z42.string(),
+var SubmitCodeReviewResultRequestSchema = z32.object({
+  sessionId: z32.string(),
+  approved: z32.boolean(),
+  content: z32.string(),
   // Canonical risk level the reviewer assigned to this change. Required on every
   // verdict — the reviewer must judge it. Applied authoritatively server-side
   // (may raise OR lower an already-set value; the reviewer has that authority).
@@ -3797,177 +3833,165 @@ var SubmitCodeReviewResultRequestSchema = z42.object({
   // The commit SHA the reviewer actually reviewed. When present, the verdict is
   // rejected unless the task is still at this SHA (guards against a late
   // old-SHA verdict overwriting a newer review cycle).
-  reviewedSha: z42.string().optional()
-});
-var CycleCodingAgentKeyRequestSchema = z42.object({
-  sessionId: z42.string(),
-  rateLimitType: z42.string(),
-  resetsAt: z42.string().optional()
-});
-var StartChildCloudBuildRequestSchema = z42.object({
-  sessionId: z42.string(),
-  childTaskId: z42.string()
-});
-var StopChildBuildRequestSchema = z42.object({
-  sessionId: z42.string(),
-  childTaskId: z42.string()
-});
-var ApproveAndMergePRRequestSchema = z42.object({
-  sessionId: z42.string(),
-  childTaskId: z42.string()
-});
-var PostChildChatMessageRequestSchema = z42.object({
-  sessionId: z42.string(),
-  childTaskId: z42.string(),
-  message: z42.string().min(1)
-});
-var UpdateChildStatusRequestSchema = z42.object({
-  sessionId: z42.string(),
-  childTaskId: z42.string(),
-  status: z42.string()
-});
-var GetAgentStatusRequestSchema = z42.object({
-  taskId: z42.string()
-});
-var GetUiCliHistoryRequestSchema = z42.object({
-  taskId: z42.string()
-});
-var GetActivePtySessionRequestSchema = z42.object({
-  taskId: z42.string()
-});
-var ListActivePtySessionsRequestSchema = z42.object({
-  taskId: z42.string()
-});
-var SendSoftStopRequestSchema = z42.object({
-  taskId: z42.string()
-});
-var StopTaskSessionRequestSchema = z42.object({
-  taskId: z42.string(),
-  sessionId: z42.string()
-});
-var FlushTaskQueueRequestSchema = z42.object({
-  taskId: z42.string(),
-  softStop: z42.boolean().optional()
-});
-var CancelTaskQueuedMessageRequestSchema = z42.object({
-  taskId: z42.string(),
-  messageId: z42.string()
-});
-var FlushSingleQueuedMessageRequestSchema = z42.object({
-  taskId: z42.string(),
-  messageId: z42.string(),
-  softStop: z42.boolean().optional()
-});
-var AnswerAgentQuestionRequestSchema = z42.object({
-  taskId: z42.string(),
-  requestId: z42.string(),
-  answers: z42.record(z42.string(), z42.string())
-});
-var ClearAgentTodosRequestSchema = z42.object({
-  taskId: z42.string()
-});
-var AgentQuestionOptionSchema = z42.object({
-  label: z42.string(),
-  description: z42.string(),
-  preview: z42.string().optional()
-});
-var AgentQuestionSchema = z42.object({
-  question: z42.string(),
-  header: z42.string(),
-  options: z42.array(AgentQuestionOptionSchema),
-  multiSelect: z42.boolean().optional()
-});
-var AskUserQuestionRequestSchema = z42.object({
-  sessionId: z42.string(),
-  question: z42.string().min(1),
-  requestId: z42.string().min(1),
-  questions: z42.array(AgentQuestionSchema).min(1)
-});
-var PostAgentMessageRequestSchema = z42.object({
-  sessionId: z42.string().min(1),
-  content: z42.string(),
-  milestone: z42.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
-});
-var EmitAgentEventRequestSchema = z42.object({
-  sessionId: z42.string(),
-  events: z42.array(AgentEventSchema).max(500)
-});
-var RefreshGithubTokenRequestSchema = z42.object({
-  sessionId: z42.string(),
-  forceFresh: z42.boolean().optional()
-});
-var ReportCredentialFailureRequestSchema = z42.object({
-  sessionId: z42.string(),
-  error: z42.string().max(2e3).optional(),
-  tokenShape: z42.string().max(500).optional(),
-  healed: z42.boolean().optional()
-});
-var ReportReviewSpawnFailureRequestSchema = z42.object({
-  sessionId: z42.string(),
-  reviewSessionId: z42.string(),
-  error: z42.string().max(2e3).optional()
+  reviewedSha: z32.string().optional()
+});
+var CycleCodingAgentKeyRequestSchema = z32.object({
+  sessionId: z32.string(),
+  rateLimitType: z32.string(),
+  resetsAt: z32.string().optional()
+});
+var PostChildChatMessageRequestSchema = z32.object({
+  sessionId: z32.string(),
+  childTaskId: z32.string(),
+  message: z32.string().min(1)
+});
+var UpdateChildStatusRequestSchema = z32.object({
+  sessionId: z32.string(),
+  childTaskId: z32.string(),
+  status: z32.string()
+});
+var GetAgentStatusRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var GetUiCliHistoryRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var GetActivePtySessionRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var ListActivePtySessionsRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var SendSoftStopRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var StopTaskSessionRequestSchema = z32.object({
+  taskId: z32.string(),
+  sessionId: z32.string()
+});
+var FlushTaskQueueRequestSchema = z32.object({
+  taskId: z32.string(),
+  softStop: z32.boolean().optional()
+});
+var CancelTaskQueuedMessageRequestSchema = z32.object({
+  taskId: z32.string(),
+  messageId: z32.string()
+});
+var FlushSingleQueuedMessageRequestSchema = z32.object({
+  taskId: z32.string(),
+  messageId: z32.string(),
+  softStop: z32.boolean().optional()
+});
+var AnswerAgentQuestionRequestSchema = z32.object({
+  taskId: z32.string(),
+  requestId: z32.string(),
+  answers: z32.record(z32.string(), z32.string())
+});
+var ClearAgentTodosRequestSchema = z32.object({
+  taskId: z32.string()
+});
+var AgentQuestionOptionSchema = z32.object({
+  label: z32.string(),
+  description: z32.string(),
+  preview: z32.string().optional()
+});
+var AgentQuestionSchema = z32.object({
+  question: z32.string(),
+  header: z32.string(),
+  options: z32.array(AgentQuestionOptionSchema),
+  multiSelect: z32.boolean().optional()
+});
+var AskUserQuestionRequestSchema = z32.object({
+  sessionId: z32.string(),
+  question: z32.string().min(1),
+  requestId: z32.string().min(1),
+  questions: z32.array(AgentQuestionSchema).min(1)
+});
+var PostAgentMessageRequestSchema = z32.object({
+  sessionId: z32.string().min(1),
+  content: z32.string(),
+  milestone: z32.enum(["plan_ready", "implementation_complete", "blocked"]).optional()
+});
+var EmitAgentEventRequestSchema = z32.object({
+  sessionId: z32.string(),
+  events: z32.array(AgentEventSchema).max(500)
+});
+var RefreshGithubTokenRequestSchema = z32.object({
+  sessionId: z32.string(),
+  forceFresh: z32.boolean().optional()
+});
+var ReportCredentialFailureRequestSchema = z32.object({
+  sessionId: z32.string(),
+  error: z32.string().max(2e3).optional(),
+  tokenShape: z32.string().max(500).optional(),
+  healed: z32.boolean().optional()
+});
+var ReportReviewSpawnFailureRequestSchema = z32.object({
+  sessionId: z32.string(),
+  reviewSessionId: z32.string(),
+  error: z32.string().max(2e3).optional()
 });
 var ReportBuilderSpawnFailureRequestSchema = ReportReviewSpawnFailureRequestSchema.omit({
   reviewSessionId: true
-}).extend({ buildSessionId: z42.string() });
-var SpawnTaskSessionRequestSchema = z42.object({
-  taskId: z42.string(),
-  kind: z42.enum(["tui", "shell"])
+}).extend({ buildSessionId: z32.string() });
+var SpawnTaskSessionRequestSchema = z32.object({
+  taskId: z32.string(),
+  kind: z32.enum(["tui", "shell"])
 });
-var StartCodeReviewRequestSchema = z42.object({
-  taskId: z42.string(),
-  force: z42.boolean().optional()
+var StartCodeReviewRequestSchema = z32.object({
+  taskId: z32.string(),
+  force: z32.boolean().optional()
 });
-var StopCodeReviewRequestSchema = z42.object({
-  taskId: z42.string()
+var StopCodeReviewRequestSchema = z32.object({
+  taskId: z32.string()
 });
-var ReportSessionSpawnFailureRequestSchema = z42.object({
-  sessionId: z42.string(),
-  spawnedSessionId: z42.string(),
-  error: z42.string().max(2e3).optional()
+var ReportSessionSpawnFailureRequestSchema = z32.object({
+  sessionId: z32.string(),
+  spawnedSessionId: z32.string(),
+  error: z32.string().max(2e3).optional()
 });
-var RefreshGithubTokenResponseSchema = z42.object({
-  token: z42.string()
+var RefreshGithubTokenResponseSchema = z32.object({
+  token: z32.string()
 });
 var PTY_FRAME_MAX_CHARS = 256 * 1024;
 var PTY_MAX_DIMENSION = 1e3;
-var PtyOutputRequestSchema = z42.object({
-  sessionId: z42.string(),
-  data: z42.string().max(PTY_FRAME_MAX_CHARS),
-  cols: z42.number().int().positive().max(PTY_MAX_DIMENSION).optional(),
-  rows: z42.number().int().positive().max(PTY_MAX_DIMENSION).optional()
+var PtyOutputRequestSchema = z32.object({
+  sessionId: z32.string(),
+  data: z32.string().max(PTY_FRAME_MAX_CHARS),
+  cols: z32.number().int().positive().max(PTY_MAX_DIMENSION).optional(),
+  rows: z32.number().int().positive().max(PTY_MAX_DIMENSION).optional()
 });
-var PtyEndedRequestSchema = z42.object({
-  sessionId: z42.string()
+var PtyEndedRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var PtyInputRequestSchema = z42.object({
-  sessionId: z42.string(),
-  data: z42.string().max(PTY_FRAME_MAX_CHARS)
+var PtyInputRequestSchema = z32.object({
+  sessionId: z32.string(),
+  data: z32.string().max(PTY_FRAME_MAX_CHARS)
 });
-var PtyResizeRequestSchema = z42.object({
-  sessionId: z42.string(),
-  cols: z42.number().int().positive().max(PTY_MAX_DIMENSION),
-  rows: z42.number().int().positive().max(PTY_MAX_DIMENSION)
+var PtyResizeRequestSchema = z32.object({
+  sessionId: z32.string(),
+  cols: z32.number().int().positive().max(PTY_MAX_DIMENSION),
+  rows: z32.number().int().positive().max(PTY_MAX_DIMENSION)
 });
-var PtyAttachRequestSchema = z42.object({
-  sessionId: z42.string()
+var PtyAttachRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var ReportPtyStreamRequestSchema = z42.object({
-  sessionId: z42.string(),
-  port: z42.number().int().positive().max(65535).nullable()
+var ReportPtyStreamRequestSchema = z32.object({
+  sessionId: z32.string(),
+  port: z32.number().int().positive().max(65535).nullable()
 });
-var GetPtyStreamEndpointRequestSchema = z42.object({
-  sessionId: z42.string()
+var GetPtyStreamEndpointRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var PtyChatEventPayloadSchema = z42.discriminatedUnion("kind", [
-  z42.object({
-    kind: z42.literal("init"),
-    model: z42.string().max(200),
-    claudeSessionId: z42.string().max(100).optional()
+var PtyChatEventPayloadSchema = z32.discriminatedUnion("kind", [
+  z32.object({
+    kind: z32.literal("init"),
+    model: z32.string().max(200),
+    claudeSessionId: z32.string().max(100).optional()
   }),
-  z42.object({
-    kind: z42.literal("user_text"),
-    text: z42.string().max(16384),
+  z32.object({
+    kind: z32.literal("user_text"),
+    text: z32.string().max(16384),
     // Set by the SERVER (never the agent) when this prompt was injected by
     // Conveyor rather than typed by a human — the routed message's `source`
     // (`ci_success`, `review_trigger`, `automated_feedback`, …). The agent
@@ -3975,69 +3999,75 @@ var PtyChatEventPayloadSchema = z42.discriminatedUnion("kind", [
     // CLI records both as plain transcript `user` records; without this the
     // builder chat renders "All CI checks passed on your PR." as the human's
     // own bubble. Absent ⇒ a genuine human prompt.
-    source: z42.string().max(60).optional()
+    source: z32.string().max(60).optional()
   }),
-  z42.object({ kind: z42.literal("assistant_text"), text: z42.string().max(16384) }),
-  z42.object({
-    kind: z42.literal("tool_use"),
-    name: z42.string().max(200),
+  z32.object({ kind: z32.literal("assistant_text"), text: z32.string().max(16384) }),
+  z32.object({
+    kind: z32.literal("tool_use"),
+    name: z32.string().max(200),
     // Compact preview: JSON.stringify(input) truncated agent-side. The cap
     // matches the text events because AskUserQuestion payloads ride this field
     // and the web lifts them into an interactive card — a tight cap forced
     // option descriptions down to 80 chars, making them unreadable. Every
     // other tool keeps a far smaller agent-side budget (`TOOL_INPUT_MAX` in
     // `chat-record-mapper.ts`), so the ring does not grow for normal calls.
-    input: z42.string().max(16384),
+    input: z32.string().max(16384),
     // Transcript tool_use block id — lets the client pair the tool_result.
-    id: z42.string().max(100).optional()
+    id: z32.string().max(100).optional()
   }),
-  z42.object({
-    kind: z42.literal("tool_result"),
+  z32.object({
+    kind: z32.literal("tool_result"),
     // tool_use block id this result answers (absent on malformed records).
-    toolUseId: z42.string().max(100).optional(),
+    toolUseId: z32.string().max(100).optional(),
     // Compact output preview, truncated agent-side.
-    output: z42.string().max(2e3),
-    isError: z42.boolean().optional()
+    output: z32.string().max(2e3),
+    isError: z32.boolean().optional()
   }),
-  z42.object({ kind: z42.literal("turn_end") })
+  z32.object({ kind: z32.literal("turn_end") })
 ]);
-var PtyChatEventRequestSchema = z42.object({
-  sessionId: z42.string(),
+var PtyChatEventRequestSchema = z32.object({
+  sessionId: z32.string(),
   event: PtyChatEventPayloadSchema
 });
-var PtyChatAttachRequestSchema = z42.object({
-  sessionId: z42.string()
+var PtyChatAttachRequestSchema = z32.object({
+  sessionId: z32.string()
 });
-var CreatePRResponseSchema = z42.object({
-  prNumber: z42.number().int().positive(),
-  prUrl: z42.string().url(),
+var CreatePRResponseSchema = z32.object({
+  prNumber: z32.number().int().positive(),
+  prUrl: z32.string().url(),
   /** Advisory glossary-upkeep note derived from the PR's changed files matched
    *  against tag contextPaths — rendered into the tool result, never stored. */
-  glossaryNote: z42.string().optional()
+  glossaryNote: z32.string().optional()
 });
-var PostToChatResponseSchema = z42.object({
-  messageId: z42.string()
+var PostToChatResponseSchema = z32.object({
+  messageId: z32.string()
 });
-var UpdateTaskStatusResponseSchema = z42.object({
-  taskId: z42.string(),
-  status: z42.string()
+var UpdateTaskStatusResponseSchema = z32.object({
+  taskId: z32.string(),
+  status: z32.string()
 });
-var StoreSessionIdResponseSchema = z42.object({
-  success: z42.boolean()
+var StoreSessionIdResponseSchema = z32.object({
+  success: z32.boolean()
 });
-var HeartbeatResponseSchema = z42.object({
-  acknowledged: z42.boolean()
+var HeartbeatResponseSchema = z32.object({
+  acknowledged: z32.boolean()
 });
-var SessionStartResponseSchema = z42.object({
-  sessionId: z42.string(),
-  startedAt: z42.string()
+var SessionStartResponseSchema = z32.object({
+  sessionId: z32.string(),
+  startedAt: z32.string()
 });
-var SessionStopResponseSchema = z42.object({
-  sessionId: z42.string(),
-  stoppedAt: z42.string()
+var SessionStopResponseSchema = z32.object({
+  sessionId: z32.string(),
+  stoppedAt: z32.string()
+});
+var DeleteSubtaskResponseSchema = z32.object({
+  deleted: z32.boolean()
 });
-var DeleteSubtaskResponseSchema = z42.object({
-  deleted: z42.boolean()
+var ParkOnCheckResultRequestSchema = z42.object({
+  sessionId: z42.string(),
+  sha: z42.string().regex(/^[0-9a-f]{7,40}$/i).optional(),
+  prNumber: z42.number().int().positive().optional(),
+  timeoutMinutes: z42.number().int().min(1).max(MAX_CI_WAIT_TIMEOUT_MINUTES).optional()
 });
 var GIT_BRANCH_NAME_MAX = 255;
 var GIT_BRANCH_NAME_MESSAGE = "Invalid git branch name \u2014 use only letters, numbers, '.', '_', '/' and '-', starting with a letter or number, with no '..', '@{' or '//', and no trailing '/', '-', '.' or '.lock'";
@@ -4330,6 +4360,7 @@ var ListProjectSessionGroupsRequestSchema = z52.object({
   projectId: z52.string()
 });
 var ListMyLiveSessionsAcrossProjectsRequestSchema = z52.object({});
+var ListSessionGroupsAcrossProjectsRequestSchema = z52.object({});
 var GetProjectAvailableTuisRequestSchema = z52.object({
   projectId: z52.string()
 });
@@ -4772,129 +4803,129 @@ var MEETING_TITLE_MAX = 200;
 var MEETING_OCCURRED_AT_MIN_YEAR = 2e3;
 var MEETING_OCCURRED_AT_MAX_FUTURE_MS = 48 * 60 * 60 * 1e3;
 var OCCURRED_AT_RANGE_MESSAGE = `occurredAt must be a real date: no earlier than ${MEETING_OCCURRED_AT_MIN_YEAR}, and no more than 48 hours in the future.`;
-var MeetingOccurredAtSchema = z10.string().datetime().refine((value) => {
+var MeetingOccurredAtSchema = z102.string().datetime().refine((value) => {
   const ms = Date.parse(value);
   if (Number.isNaN(ms)) return false;
   if (ms > Date.now() + MEETING_OCCURRED_AT_MAX_FUTURE_MS) return false;
   return new Date(ms).getUTCFullYear() >= MEETING_OCCURRED_AT_MIN_YEAR;
 }, OCCURRED_AT_RANGE_MESSAGE);
-var CreateMeetingFromTranscriptRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  rawText: z10.string().min(1).max(MEETING_TRANSCRIPT_MAX_CHARS),
-  title: z10.string().min(1).max(MEETING_TITLE_MAX).optional(),
+var CreateMeetingFromTranscriptRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  rawText: z102.string().min(1).max(MEETING_TRANSCRIPT_MAX_CHARS),
+  title: z102.string().min(1).max(MEETING_TITLE_MAX).optional(),
   /** ISO 8601. Defaults to now when the source carries no date. */
   occurredAt: MeetingOccurredAtSchema.optional(),
   /** Override auto-detection. Rarely needed; detection handles the three formats. */
-  format: z10.enum(["text", "vtt", "srt"]).optional(),
-  source: z10.enum(["manual", "slack"]).optional()
+  format: z102.enum(["text", "vtt", "srt"]).optional(),
+  source: z102.enum(["manual", "slack"]).optional()
 });
-var GetMeetingRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid()
+var GetMeetingRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid()
 });
-var UpdateMeetingRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  title: z10.string().min(1).max(MEETING_TITLE_MAX).optional(),
+var UpdateMeetingRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  title: z102.string().min(1).max(MEETING_TITLE_MAX).optional(),
   occurredAt: MeetingOccurredAtSchema.optional()
 });
-var RegenerateMeetingSummaryRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid()
+var RegenerateMeetingSummaryRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid()
 });
-var DeleteMeetingRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid()
+var DeleteMeetingRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid()
 });
-var checklistTitle = z10.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX);
-var ListMeetingChecklistRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid()
+var checklistTitle = z102.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX);
+var ListMeetingChecklistRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid()
 });
-var AddMeetingChecklistItemsRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  items: z10.array(z10.object({ title: checklistTitle })).min(1).max(50)
+var AddMeetingChecklistItemsRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  items: z102.array(z102.object({ title: checklistTitle })).min(1).max(50)
 });
-var UpdateMeetingChecklistItemRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  itemId: z10.string().cuid(),
+var UpdateMeetingChecklistItemRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  itemId: z102.string().cuid(),
   title: checklistTitle.optional(),
-  ordinal: z10.number().int().min(0).optional(),
+  ordinal: z102.number().int().min(0).optional(),
   /** Explicit null clears the link; undefined leaves it alone. */
-  linkedTaskId: z10.string().cuid().nullable().optional()
+  linkedTaskId: z102.string().cuid().nullable().optional()
 }).refine(
   (v) => v.title !== void 0 || v.ordinal !== void 0 || v.linkedTaskId !== void 0,
   "Pass at least one of title, ordinal, or linkedTaskId."
 );
-var DeleteMeetingChecklistItemRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  itemId: z10.string().cuid()
-});
-var SetMeetingChecklistItemCheckedRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  itemId: z10.string().cuid(),
-  checked: z10.boolean(),
+var DeleteMeetingChecklistItemRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  itemId: z102.string().cuid()
+});
+var SetMeetingChecklistItemCheckedRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  itemId: z102.string().cuid(),
+  checked: z102.boolean(),
   /** Attach the card in the same call that ticks the item. */
-  linkedTaskId: z10.string().cuid().nullable().optional()
+  linkedTaskId: z102.string().cuid().nullable().optional()
 });
-var ListMeetingsRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  limit: z10.number().int().min(1).max(50).optional(),
-  search: z10.string().max(200).optional()
+var ListMeetingsRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  limit: z102.number().int().min(1).max(50).optional(),
+  search: z102.string().max(200).optional()
 });
-var ReadMeetingTranscriptRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  offset: z10.number().int().min(0).optional(),
-  limit: z10.number().int().min(1).max(500).optional()
+var ReadMeetingTranscriptRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  offset: z102.number().int().min(0).optional(),
+  limit: z102.number().int().min(1).max(500).optional()
 });
 var MEETING_SUMMARY_MAX_CHARS = 5e4;
-var AddProjectMeetingChecklistItemsRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  items: z10.array(z10.object({ title: z10.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX) })).min(1).max(50),
-  requestingUserId: z10.string().optional()
-});
-var CheckProjectMeetingChecklistItemRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  title: z10.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
-  checked: z10.boolean(),
+var AddProjectMeetingChecklistItemsRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  items: z102.array(z102.object({ title: z102.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX) })).min(1).max(50),
+  requestingUserId: z102.string().optional()
+});
+var CheckProjectMeetingChecklistItemRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  title: z102.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
+  checked: z102.boolean(),
   /** Card id or slug. Resolved server-side and required to be in the project. */
-  linkedTask: z10.string().min(1).optional(),
-  requestingUserId: z10.string().optional()
-});
-var EditProjectMeetingChecklistItemRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  title: z10.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
-  newTitle: z10.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
-  requestingUserId: z10.string().optional()
-});
-var RemoveProjectMeetingChecklistItemRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  title: z10.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
-  requestingUserId: z10.string().optional()
-});
-var CreateProjectMeetingRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  rawText: z10.string().min(1).max(MEETING_TRANSCRIPT_MAX_CHARS),
-  title: z10.string().min(1).max(MEETING_TITLE_MAX).optional(),
+  linkedTask: z102.string().min(1).optional(),
+  requestingUserId: z102.string().optional()
+});
+var EditProjectMeetingChecklistItemRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  title: z102.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
+  newTitle: z102.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
+  requestingUserId: z102.string().optional()
+});
+var RemoveProjectMeetingChecklistItemRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  title: z102.string().min(1).max(MEETING_CHECKLIST_TITLE_MAX),
+  requestingUserId: z102.string().optional()
+});
+var CreateProjectMeetingRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  rawText: z102.string().min(1).max(MEETING_TRANSCRIPT_MAX_CHARS),
+  title: z102.string().min(1).max(MEETING_TITLE_MAX).optional(),
   occurredAt: MeetingOccurredAtSchema.optional(),
-  requestingUserId: z10.string().optional()
+  requestingUserId: z102.string().optional()
 });
-var UpdateProjectMeetingRequestSchema = z10.object({
-  projectId: z10.string().cuid(),
-  meetingId: z10.string().cuid(),
-  title: z10.string().min(1).max(MEETING_TITLE_MAX).optional(),
+var UpdateProjectMeetingRequestSchema = z102.object({
+  projectId: z102.string().cuid(),
+  meetingId: z102.string().cuid(),
+  title: z102.string().min(1).max(MEETING_TITLE_MAX).optional(),
   occurredAt: MeetingOccurredAtSchema.optional(),
-  summary: z10.string().min(1).max(MEETING_SUMMARY_MAX_CHARS).optional(),
-  requestingUserId: z10.string().optional()
+  summary: z102.string().min(1).max(MEETING_SUMMARY_MAX_CHARS).optional(),
+  requestingUserId: z102.string().optional()
 }).refine(
   (v) => v.title !== void 0 || v.occurredAt !== void 0 || v.summary !== void 0,
   "Pass at least one of title, occurredAt, or summary."
@@ -4991,11 +5022,13 @@ var CATALOG = {
       // CPU: the request is the CFS floor; the old 50m starved postgres to 5ms
       // of CPU per 100ms period — every query burst hit throttle stalls, which
       // showed up as ~100ms floors on trivial statements and dominated the API
-      // int suite even after the fsync flags above. 500m is paid for out of the
-      // agent's derived share (resource-tiers.ts). The limit bursts to 2 for
-      // spiky work — the first-boot pod-data seed copy and int-suite query
-      // storms — borrowing idle node CPU without moving the request.
-      requests: { cpuMillicores: 500, memoryMi: 512, ephemeralMi: 3 * 1024 },
+      // int suite even after the fsync flags above. 250m is paid for out of the
+      // workbench's derived share (resource-tiers.ts); measured across the fleet
+      // postgres peaks at 0.66 cores and idles far below 250m, and the limit
+      // (unchanged at 2) is what serves the peaks: the first-boot pod-data seed
+      // copy and int-suite query storms borrow idle node CPU without moving the
+      // request.
+      requests: { cpuMillicores: 250, memoryMi: 512, ephemeralMi: 3 * 1024 },
       limits: { cpuMillicores: 2e3, memoryMi: 512, ephemeralMi: 3 * 1024 }
     },
     connectionEnv: {
@@ -5049,6 +5082,10 @@ var CATALOG = {
     // rejects (media_type_header_exception), breaking search/audit indexing
     // in pods. 512m heap matches the project compose sizing.
     image: "docker.elastic.co/elasticsearch/elasticsearch:9.4.0",
+    mirror: {
+      src: "docker.elastic.co/elasticsearch/elasticsearch:9.4.0",
+      dest: "mirror-elasticsearch:9.4.0"
+    },
     ports: [9200],
     // Baked service images are `docker commit`s of a recently-running ES, so
     // they carry a stale data-dir node.lock; ES 9 hard-fails on it at boot
@@ -5072,14 +5109,16 @@ var CATALOG = {
       ES_JAVA_OPTS: "-Xms512m -Xmx512m"
     },
     resources: {
-      // CPU limit 4x the request: ES cold-start is a CPU-bound JVM boot
+      // CPU limit 8x the request: ES cold-start is a CPU-bound JVM boot
       // (class loading + JIT + recovery of the docker-commit'ed data dir),
-      // and the 500m hard cap put it at ~135s to yellow — past the sidecar
+      // and a 500m hard cap put it at ~135s to yellow, past the sidecar
       // wait script's original 90s budget. Bursting to 2 cut it to ~40s on
       // the real cluster (A/B on identical nodes, 2 rounds). The burst only
       // borrows idle node CPU at boot; under contention CFS still floors ES
-      // at its 500m request.
-      requests: { cpuMillicores: 500, memoryMi: 1024, ephemeralMi: 256 },
+      // at its request. That request is 250m: the fleet-wide peak is 1.6
+      // cores (served by the limit) and steady state is far below 250m, so
+      // the old 500m only inflated the billed pod total.
+      requests: { cpuMillicores: 250, memoryMi: 1024, ephemeralMi: 256 },
       limits: { cpuMillicores: 2e3, memoryMi: 1024, ephemeralMi: 256 }
     },
     connectionEnv: {
@@ -5131,6 +5170,10 @@ var CATALOG = {
     resources: {
       // Autopilot caps the ephemeral-storage limit to the request (see the
       // postgresql note), so the 1Gi headroom must be on the request too.
+      // CPU: the collector draws ~0.3 cores at idle fleet-wide, so the request
+      // stays at 250m to cover that draw under node contention (a request
+      // below usage is a container CFS throttles continuously); the 1-core
+      // limit covers ingest bursts.
       requests: { cpuMillicores: 250, memoryMi: 1024, ephemeralMi: 1024 },
       limits: { cpuMillicores: 1e3, memoryMi: 2048, ephemeralMi: 1024 }
     },